Gargoyle Forum

Code: Select all

iptables -t filter -A lease_mismatch_check  -s  "$ip" -m mac ! --mac-source "$mac"  -j REJECT

Code: Select all

jh@rpi01-jh:~ $man iptables-extensions
.
.
mac
[!] --mac-source address
Match source MAC address. It must be of the form XX:XX:XX:XX:XX:XX. Note that this only makes sense for packets coming from an Ethernet device and entering the PREROUTING, FORWARD or INPUT chains. 
.
.

Code: Select all

iptables -t filter -A lease_mismatch_check  -s  "$ip" -m mac ! --mac-source "$mac"  -j REJECT

Code: Select all

block_static_ip_mismatches()
{
	block_mismatches=$(uci get firewall.@defaults[0].block_static_ip_mismatches 2> /dev/null)
	delete_chain_from_table static_mismatch_check filter
	if [ "$block_mismatches" = "1" ] && [ -e /etc/ethers ] ; then
		local pairs
		pairs=$(cat /etc/ethers | sed '/^[ \t]*$/d' | awk ' { print $1"^"$2"\n" ; } ' )
		if [ -n "$pairs" ] ; then
			iptables -t filter -N static_mismatch_check
			local p
			for p in $pairs ; do
				local mac
				local ip
				mac=$(echo $p | sed 's/\^.*$//g')
				ip=$(echo $p | sed 's/^.*\^//g')
				if [ -n "$ip" ] && [ -n "$mac" ] ; then
					iptables -t filter -A static_mismatch_check  ! -s  "$ip"  -m mac --mac-source  "$mac"  -j REJECT
				fi
			done
			iptables -t filter -I delegate_forward -j static_mismatch_check
		fi
	fi
}

Code: Select all

iptables -t filter -A lease_mismatch_check  -s  "$ip" -m mac ! --mac-source "$mac"  -j REJECT

Code: Select all

for p in $pairs ; do
   local mac
   local ip
   mac=$(echo $p | sed 's/\^.*$//g')
   ip=$(echo $p | sed 's/^.*\^//g')
   if [ -n "$ip" ] && [ -n "$mac" ] ; then
      iptables -t filter -A lease_mismatch_check  ! -s  "$ip"  -m mac --mac-source  "$mac"  -j REJECT
      iptables -t filter -A lease_mismatch_check  -s  "$ip" -m mac ! --mac-source "$mac"  -j REJECT
   fi
done

Code: Select all

/etc/init.d/firewall restart

Code: Select all

for p in $pairs ; do
   local mac
   local ip
   mac=$(echo $p | sed 's/\^.*$//g')
   ip=$(echo $p | sed 's/^.*\^//g')
   if [ -n "$ip" ] && [ -n "$mac" ] ; then
      iptables -t filter -A lease_mismatch_check  ! -s  "$ip"  -m mac --mac-source  "$mac"  -j REJECT
      iptables -t filter -A lease_mismatch_check  -s  "$ip" -m mac ! --mac-source "$mac"  -j REJECT
   fi
done