Shorewall users - Apr 2005 - MAC Adress / Iptables/ Shorewall

Hello,

I use Shorewall 2.0.16 on my server.
I would like to auhtorized some external desktop to connect my network. The
desktop''s IP change always, because they use dynamic addresses and they
haven''t static IP. So I would like to filter those desktop...With
shorewall,
I can use an IP to drop, reject...But in my case, I can use it. So I think
to use a filter on the MAC address. In documentation, it seems that
shorewall filters MAC address only for the machine which are on the same
network. So this solution doesn''t work for me .
I''ve think to add iptable rules in more to Shorewal rule. If in my
shorewall
rules and policy I drop all external adress and I add a rule in iptable like
"ACCEPT this_mac_adress", does it work ? What the first rule will be
executed : shorewall or iptables ?

Could you say me how I can use mac address to filtrer external address ?

Best regards
Arnaud FARINE
Atos Origin
Système Intégration
150, Allée Pierre Ziller
06905 Sophia-Antipolis
France
Phone +33 (0)49 715 7918
Fax +33 (0)49 715 7901
arnaud.farine@atosorigin.com
www.si.fr.atosorigin.com
********************************************
Ce message électronique est confidentiel. Il peut contenir des informations
protégées par le secret professionnel, le secret de fabrication ou autres
règles légales. Si vous recevez ce message par erreur, il vous est interdit
de le reproduire ou de le distribuer en tout ou partie, ou de le divulguer
de quelque manière que ce soit à quelque personne que ce soit. Nous vous
prions de bien vouloir en informer Atos Origin, par téléphone ou par retour
d''e-mail puis de détruire le message et toutes copies de votre système
informatique.
Le contenu de ce message ne reflète pas nécessairement ni les opinions
d''Atos Origin ni celles des membres de son groupe. Bien que
l''émetteur de ce
message ait fait tout son possible pour maintenir son système informatique
sans virus, il ne peut garantir que cette transmission ne comporte aucun
virus et il ne pourra être tenu pour responsable de quelque dommage que ce
soit résultant de la transmission d''un virus.
********************************************
This electronic transmission is confidential. It may contain information
that is covered by legal professional privilege, work product immunity or
other legal rules. If you have received this transmission in error, you must
not copy or distribute this message or any part of it or otherwise disclose
its contents to anyone. Please notify Atos Origin by phone or return E-mail,
and then delete this transmission and any copies of it from your computer
system. The views expressed in this electronic transmission do not
necessarily reflect those of Atos Origin or any member of its group.
Although the sender endeavours to maintain a computer virus free network,
the sender does not warrant that this transmission is virus free and will
not be liable for any damages resulting from any virus transmitted.
*******************************************

Arnaud Farine a écrit :
>Hello,
>
>I use Shorewall 2.0.16 on my server.
>I would like to auhtorized some external desktop to connect my network. The
>desktop''s IP change always, because they use dynamic addresses and
they
>haven''t static IP. So I would like to filter those desktop...With
shorewall,
>I can use an IP to drop, reject...But in my case, I can use it. So I think
>to use a filter on the MAC address. In documentation, it seems that
>shorewall filters MAC address only for the machine which are on the same
>network. So this solution doesn''t work for me .
>I''ve think to add iptable rules in more to Shorewal rule. If in my
shorewall
>rules and policy I drop all external adress and I add a rule in iptable like
>"ACCEPT this_mac_adress", does it work ? 
>
I think no
>What the first rule will be
>executed : shorewall or iptables ?
>
>Could you say me how I can use mac address to filtrer external address ?
>
ebtables or arptables.

regards,

Ben

Arnaud Farine wrote:
> Hello,
> 
> Could you say me how I can use mac address to filtrer external address ?
> 
The documentation clearly states that it isn''t possible -- why ask how
to do it then?

And this isn''t a Shorewall restriction -- it''s the way that
Ethernet
addressing works in conjunction with IP.

If you want to selectively allow hosts access to services on your
systems and those hosts don''t have static IP addresses and are not on
the same LAN as your firewall then you must install a VPN server and
make the remote users authenticate themselves to that server using
username/password, X.509 certifications , ...

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key