iptables: blocking SAMBA traffic, but allowing from specific MAC addresses

Submitted by Jochus on Thu, 02/12/2010 - 10:10 | Posted in:


My god, it took me hours to configure the following setup. I want to block SAMBA traffic to all other clients, but allow them from specific hosts by MAC address:

1/ I keep the INPUT chain to policy ACCEPT
2/ I allow traffic on specific MAC address

$ iptables -A INPUT --protocol tcp --destination-port 135:139 -m mac --mac-source ##REPLACE_BY_YOUR_MAC_ADDRESS## -j ACCEPT
$ iptables -A INPUT --protocol tcp --source-port 135:139 -m mac --mac-source ##REPLACE_BY_YOUR_MAC_ADDRESS## -j ACCEPT
$ iptables -A INPUT --protocol udp --destination-port 135:139 -m mac --mac-source ##REPLACE_BY_YOUR_MAC_ADDRESS## -j ACCEPT
$ iptables -A INPUT --protocol udp --source-port 135:139 -m mac --mac-source ##REPLACE_BY_YOUR_MAC_ADDRESS## -j ACCEPT
$ iptables -A INPUT --protocol tcp --destination-port 445 -m mac --mac-source ##REPLACE_BY_YOUR_MAC_ADDRESS## -j ACCEPT
$ iptables -A INPUT --protocol tcp --source-port 445 -m mac --mac-source ##REPLACE_BY_YOUR_MAC_ADDRESS## -j ACCEPT
$ iptables -A INPUT --protocol udp --destination-port 445 -m mac --mac-source ##REPLACE_BY_YOUR_MAC_ADDRESS## -j ACCEPT
$ iptables -A INPUT --protocol udp --source-port 445 -m mac --mac-source ##REPLACE_BY_YOUR_MAC_ADDRESS## -j ACCEPT

3/ I deny all other traffic

$ iptables -A INPUT --protocol tcp --destination-port 135:139 -j DROP
$ iptables -A INPUT --protocol tcp --source-port 135:139 -j DROP
$ iptables -A INPUT --protocol udp --destination-port 135:139 -j DROP
$ iptables -A INPUT --protocol udp --source-port 135:139 -j DROP
$ iptables -A INPUT --protocol tcp --destination-port 445 -j DROP
$ iptables -A INPUT --protocol tcp --source-port 445 -j DROP
$ iptables -A INPUT --protocol udp --destination-port 445 -j DROP
$ iptables -A INPUT --protocol udp --source-port 445 -j DROP

Add new comment

The content of this field is kept private and will not be shown publicly.
About text formats

Full HTML

  • Lines and paragraphs break automatically.
  • You can caption images (data-caption="Text"), but also videos, blockquotes, and so on.
  • Web page addresses and email addresses turn into links automatically.
  • You can enable syntax highlighting of source code with the following tags: <code>, <blockcode>, <bash>, <cpp>, <css>, <html5>, <java>, <javascript>, <php>, <sql>, <xml>. The supported tag styles are: <foo>, [foo].
CAPTCHA
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.