Iptables firewall questions.

[tvlad]

I took the fw from the Ip masquerading howto and i blocked those that i didn't want to have net in our lan by their mac addresses, i allowed myself and a couple of others by our mac addresses and then i blocked everyone by using ip ranges.

 

#------------BLOCK BY MAC ADDRESS-----------------------

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -m mac --mac-source 00:A0:D2:A4:91:25 \ -d $UNIVERSE -j DROP #CONTE

#--------------ALLOW NET ACCESS-------------------------

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -m mac --mac-source 00:02:44:41:1E:DB \

-d $UNIVERSE -j ACCEPT #VLAD

#-------------BLOCK EVERYONE ELSE----------------------

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s 192.168.0.0/16 -d $UNIVERSE -j DROP

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s 172.16.0.0/12 -d $UNIVERSE -j DROP

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s 10.0.0.0/0 -d $UNIVERSE -j DROP

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s 169.254.0.0/8 -d $UNIVERSE -j DROP

 

UNIVERSE="0.0.0.0/0"

 

Is the order in which i block and allow a good one ?,

 

And another question, would smth like -m mac --mac-source **:**:**:**:**:**

block all possible mac addresses.If not, how could i do that ???

 

Should i remove this line

# anything else outgoing on remote interface is valid

#

$IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT

Edited January 3, 2004 by tvlad