доброго времени суток
Ситуация: есть локалка, и "между" локалкой и инетом стоит шлюз, обеспечивающий dns,nat. Белый IP статичен. Форвард разрешен между интерфейсами.
Нужно: сделать запрет с помощью iptables по маку для исходящего и входящего интернет трафика (условно всего трафика что идет от "белого" статичного IP) к устройству имеющего соответствующий мак.
Общая политика все разрешено.
Прошу помощи т.к. не силен в iptables.
пробовал iptables -I INPUT -m mac --mac-source 33:33:33:33:33:33 -d 192.192.192.11 -j DROP (не работает)
up: допускаю, что общее правило запрета должно быть в "сетке" PREROUTING, ибо фильтр может сработать сразу после снятия "НАТовского" хидера с пакета и сравнения его с хэшем адресата в локалке (по существу nat'a и механизма учета "серых" адресов в стеке)
список правила на шлюзе
Chain INPUT (policy ACCEPT 17M packets, 1966M bytes)
num pkts bytes target prot opt in out source destination
1 1293 71064 fail2ban-ssh-ddos tcp -- any any anywhere anywhere multiport dports ssh
2 1293 71064 fail2ban-ssh tcp -- any any anywhere anywhere multiport dports ssh
3 1293 71064 fail2ban-ssh-ddos tcp -- any any anywhere anywhere multiport dports ssh
4 1293 71064 fail2ban-ssh tcp -- any any anywhere anywhere multiport dports ssh
5 93M 11G ufw-before-logging-input all -- any any anywhere anywhere
6 93M 11G ufw-before-input all -- any any anywhere anywhere
7 93M 11G ufw-after-input all -- any any anywhere anywhere
8 93M 11G ufw-after-logging-input all -- any any anywhere anywhere
9 93M 11G ufw-reject-input all -- any any anywhere anywhere
10 93M 11G ufw-track-input all -- any any anywhere anywhere
11 20093 1315K ACCEPT all -- lo any anywhere anywhere
12 0 0 ACCEPT tcp -- eth2 any anywhere anywhere tcp dpt:http-alt
13 1976 100K ACCEPT tcp -- any any anywhere anywhere tcp dpts:6881:6999
Chain FORWARD (policy ACCEPT 484M packets, 418G bytes)
num pkts bytes target prot opt in out source destination
1 2835M 2399G ufw-before-logging-forward all -- any any anywhere anywhere
2 2835M 2399G ufw-before-forward all -- any any anywhere anywhere
3 2835M 2399G ufw-after-forward all -- any any anywhere anywhere
4 2835M 2399G ufw-after-logging-forward all -- any any anywhere anywhere
5 2835M 2399G ufw-reject-forward all -- any any anywhere anywhere
6 2835M 2399G ufw-track-forward all -- any any anywhere anywhere
7 56M 8253M ACCEPT all -- eth0 eth2 anywhere anywhere
8 104M 127G ACCEPT all -- eth2 any anywhere anywhere state RELATED,ESTABLISHED
9 0 0 REJECT all -- eth2 eth0 anywhere anywhere reject-with icmp-port-unreachable
10 1322 71311 ACCEPT tcp -- eth2 any anywhere video-server tcp dpt:http-alt
11 8832K 1479M ACCEPT all -- eth4 eth2 anywhere anywhere
12 0 0 REJECT all -- eth2 eth4 anywhere anywhere reject-with icmp-port-unreachable
13 0 0 ACCEPT tcp -- any any 192.168.0.1 anywhere tcp dpts:6881:6889
Chain OUTPUT (policy ACCEPT 17M packets, 23G bytes)
num pkts bytes target prot opt in out source destination
1 92M 111G ufw-before-logging-output all -- any any anywhere anywhere
2 92M 111G ufw-before-output all -- any any anywhere anywhere
3 92M 111G ufw-after-output all -- any any anywhere anywhere
4 92M 111G ufw-after-logging-output all -- any any anywhere anywhere
5 92M 111G ufw-reject-output all -- any any anywhere anywhere
6 92M 111G ufw-track-output all -- any any anywhere anywhere
7 1971 78840 ACCEPT tcp -- any any anywhere anywhere tcp spts:6881:6999
Chain fail2ban-ssh (2 references)
num pkts bytes target prot opt in out source destination
1 2586 142K RETURN all -- any any anywhere anywhere
2 0 0 RETURN all -- any any anywhere anywhere
Chain fail2ban-ssh-ddos (2 references)
num pkts bytes target prot opt in out source destination
1 2586 142K RETURN all -- any any anywhere anywhere
2 0 0 RETURN all -- any any anywhere anywhere
Chain ufw-after-forward (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-after-input (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-after-logging-forward (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-after-logging-input (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-after-logging-output (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-after-output (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-before-forward (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-before-input (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-before-logging-forward (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-before-logging-input (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-before-logging-output (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-before-output (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-reject-forward (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-reject-input (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-reject-output (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-track-forward (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-track-input (1 references)
num pkts bytes target prot opt in out source destination
Chain ufw-track-output (1 references)
num pkts bytes target prot opt in out source destination