Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just want to allow only for a specific MAC Address(es) to have VNC to my Ubuntu 12.10. This would be pretty cool, because I think if I use password authentication + MAC Filter = safe.

I saw I could filter for the IP´s, but how to do this for MAC´s? Any ideas or suggestions? Thank you

share|improve this question
up vote 3 down vote accepted

Actually that doesn't make it safer at all. MAC addresses can be configured ("spoofed") on most OSs for most NIC models. An attacker could sniff traffic and simply spoof your configured MAC address.

Instead make your VNC listen on loopback and SSH into the machine, using the SSH tunnel feature to connect to VNC.

If you insist on using your insecure method, iptables (netfilter) can do that:

iptables -I INPUT -m mac --mac-source 00:XX:YY:ZZ:AA:BB -j ACCEPT

this rule added to a chain with the DROP (or REJECT) default policy would accept from the given MAC only. Can be combined further to check for other parameters as well. Basically I would hand it off to a different chain if I was you, checking first on the upper layers for connections to the relevant port(s) (5900?) and then do the MAC filtering. After all you only want to filter this single service to be available from this MAC only - not any service. If you are only interested in the MAC and the port do:

iptables -I INPUT -p tcp --destination-port 5900 -m mac --mac-source 00:XX:YY:ZZ:AA:BB -j ACCEPT

Note: -m mac requires the module mac (for netfilter), so this has to be available.

I would only use such methods to delist myself from a blacklist. For example I have configured a tar pit for SSH connection attempts (similar to what sshguard and similar programs do). Just like port knocking it could make sense to use a certain MAC as a signal to delist (i.e. remove from the blacklist) the connecting IP. But as a security mechanism by itself, no way. Too easy to fake.

share|improve this answer
Hi and thank you. For now I have a question: if I use your line 'iptables -I INPUT -m mac --mac-source 00:XX:YY:ZZ:AA:BB -j ACCEPT' - is this then only for VNC or will this block other connections to the system or to the devices in the system? I mean, I have here also a Network HDD, this should be available to everybody. – silla Apr 3 '13 at 12:34
@silla: please read my complete answer. The first one will accept only from this MAC (assuming default DROP policy), but for any service. The second one will accept for connections to TCP port 5900 (default for VNC) from that MAC but not affect other services (i.e. on ports other than 5900). – 0xC0000022L Apr 3 '13 at 12:40
sry! I did not fully understand this 'port' stuff, but now I got it. VNC = 5900 – silla Apr 3 '13 at 13:10
You should use REJECT rather then DROP, see – bodhi.zazen Apr 3 '13 at 16:40
@0xC0000022L - Thank you for reading the link. As long as one understands the difference I suppose it is personal choice, but, DROP has been advocated, but, IMO, REJECT is better, so trying to educate. – bodhi.zazen Apr 3 '13 at 17:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.