linux查看链路层数据,IPTABLE可以过滤链路层的数据包么？

elvisqin 于 2010-02-02 22:53:59发表:

Sometime it is necessary to filter address using mac address. A mac address is acronym for media access control address, is a unique address assigned to almost all-networking hardware such as Ethernet cards, router etc (see mac address at wikipedia for more information).

Iptables comes with MAC module. this matches packets traveling through the firewall based on their MAC (Ethernet hardware) address. It offers good protection against malicious users who spoof or change their IP address. Remember that mac filtering only makes sense for packets coming from an Ethernet device and entering the chains:

[list=1]

[*]PREROUTING

[*]FORWARD

[*]INPUT

[/list]

iptables blocking with mac address

Drop all connection coming from mac address 00:0F:EA:91:04:08 (add command to your firewall script)[code]iptables -A INPUT -m mac --mac-source 00:0F:EA:91:04:08 -j DROP[/code]iptables allowing with mac address

Allow port 22 for mac address 00:0F:EA:91:04:07[code]iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source

00:0F:EA:91:04:07 -j ACCEPT[/code]Read man page of iptables for more information.