Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I block every port default by ufw

and add iptables rules like this:

sudo iptables -A INPUT -p tcp --dport 1723 -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT

then I list iptables INPUT rules:

sudo iptables -L INPUT --line-numbers

Chain INPUT (policy DROP)
num  target                    prot opt source               destination
1    ACCEPT                    udp  --  anywhere             anywhere            udp dpt:domain
2    ACCEPT                    tcp  --  anywhere             anywhere            tcp dpt:domain
3    ACCEPT                    udp  --  anywhere             anywhere            udp dpt:bootps
4    ACCEPT                    tcp  --  anywhere             anywhere            tcp dpt:bootps
5    ufw-before-logging-input  all  --  anywhere             anywhere
6    ufw-before-input          all  --  anywhere             anywhere
7    ufw-after-input           all  --  anywhere             anywhere
8    ufw-after-logging-input   all  --  anywhere             anywhere
9    ufw-reject-input          all  --  anywhere             anywhere
10   ufw-track-input           all  --  anywhere             anywhere
11   ACCEPT                    tcp  --  anywhere             anywhere            tcp dpt:1723 MAC 00:11:22:33:44:55

but I can't visit my server:1723

Is there sth wrong?

I use Ubuntu 11.10

Edit01:

I add followed things:

*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines

-A ufw-before-input -p tcp --dport 1723 -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT

and then I list the rules

sudo iptables -L  ufw-before-input  --line-numbers
Chain ufw-before-input (1 references)
num  target           prot opt source               destination
1    ACCEPT           tcp  --  anywhere             anywhere            tcp dpt:1723 MAC 00:11:22:33:44:55
2    ACCEPT           all  --  anywhere             anywhere
3    ACCEPT           all  --  anywhere             anywhere            state RELATED,ESTABLISHED
4    ufw-logging-deny all  --  anywhere             anywhere            state INVALID
5    DROP             all  --  anywhere             anywhere            state INVALID
6    ACCEPT           icmp --  anywhere             anywhere            icmp destination-unreachable
7    ACCEPT           icmp --  anywhere             anywhere            icmp source-quench
8    ACCEPT           icmp --  anywhere             anywhere            icmp time-exceeded
9    ACCEPT           icmp --  anywhere             anywhere            icmp parameter-problem
10   ACCEPT           icmp --  anywhere             anywhere            icmp echo-request
11   ACCEPT           udp  --  anywhere             anywhere            udp spt:bootps dpt:bootpc
12   ufw-not-local    all  --  anywhere             anywhere
13   ACCEPT           udp  --  anywhere             224.0.0.251         udp dpt:mdns
14   ACCEPT           udp  --  anywhere             239.255.255.250     udp dpt:1900
15   ufw-user-input   all  --  anywhere             anywhere

and still not work... of course, after sudo service ufw restart I still connect the server on 1723

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Are both machines on the same ethernet subnet? mac addresses are only local to a subnet. If there's a router inbetween, the server will see the mac address of the last router the packet crosses.

Also, iptables -v -L is handy for debugging, as you can see which rules are being triggered.

share|improve this answer
    
I don't know the rule! Is there any way to filter mac address through internet? –  Tony Lee Mar 26 '12 at 10:32
    
@TonyLee. No. And MAC addresses can be trivially spoofed anyway, so restricting my MAC-address isn't going to provide much security. –  tumbleweed Mar 26 '12 at 10:34
    
Can I filter mac address after connected by vpn? –  Tony Lee Mar 26 '12 at 10:36
    
You can filter by mac address whenever you are on the same subnet. So if the VPN is a single subnet containing the client and server, then yes. –  tumbleweed Mar 26 '12 at 10:40
    
I have tested. I connect my server by pptp through internet. then my IP is 10.0.0.2, server's ip is 10.0.0.1. and the mac address filter rules not work. so thank you very much @tumbleweed –  Tony Lee Mar 26 '12 at 10:48
show 1 more comment

Rule 9 in your INPUT chain jumps to ufw-reject-input, which in turn rejects the packet.

If you want your additions to function with ufw, I suggest reading the documentation shown by man ufw-framework.

You can probably achieve what you want by creating a /etc/ufw/before.rules file with content like:

*filter
-A ufw-before-input -p tcp --dport 1723 -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT
share|improve this answer
    
thanks for your help @jamesh. I add things you adviced but still not work. see my question's edit01. –  Tony Lee Mar 26 '12 at 10:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.