Home / server / Questions / 406061
In Process
Vineet Menon
Asked: 2012-07-10 07:01:42 +0800 CST

Can I create a pf rule involving MAC address instead of IP?

  • 772

The title is self explanatory.

I want to create rules in pf running on OpenBSD 4.9 for perticular MAC address, something like

pass in on eth0 from mac 00:04:34:5f:34:33 to mac 34:32:34:06:5e:22

I have read this, but it doesn't help!!

firewall mac-address openbsd pf

2 Answers

  1. If i remember well, you can't. You can only filter mac address when you do it on a bridge if

    • 2

  2. As mandrake pointed out you can't filter by MAC address directly in PF (it's an IP packet filter, it knows not of this "ethernet" thing).

    What you CAN do, if your system is acting as a bridge, is tag packets based on MAC address, and then filter based on the tag.

    From the pf FAQ:

    Tagging Ethernet Frames

    Tagging can be performed at the Ethernet level if the machine doing the tagging/filtering is also acting as a bridge(4). By creating bridge(4) filter rules that use the tag keyword, PF can be made to filter based on the source or destination MAC address. Bridge(4) rules are created using the ifconfig(8) command.
    Example:

    # ifconfig bridge0 rule pass in on fxp0 src 0:de:ad:be:ef:0 tag USER1

    And then in pf.conf:

    pass in on fxp0 tagged USER1

    • 2