Date: Wed, 05 Sep 2007 23:14:12 -0500 From: "Chris Bowman (Home)" <chrishome@austin.rr.com> To: Stephen GL <kansas_le@yahoo.com> Cc: freebsd-ipfw@freebsd.org Subject: Re: Allow only match both mac address and IP address Message-ID: <46DF7E94.8030208@austin.rr.com> In-Reply-To: <456319.24028.qm@web56801.mail.re3.yahoo.com> References: <456319.24028.qm@web56801.mail.re3.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Stephen GL wrote: > Hi, > > I need help. > I am very new about IPFW. I'm in FreeBSD 6.0. > My job is pass anyone that has a valid both MAC and IP address. > Beginning of my rule I check the valid MAC address that can get through. > If pass, the next rule is check the IP address. > If pass, he/she can get through. > > Everything is work as expected. My problem is the above rules doesn't check both MAC and IP address pairing. Assume someone spoof other MAC address, they can pass by changing the IP address of another. > > Another question, if really someone has both valid MAC and IP address, but in fact he/she was a spoofer or man in the middle in the same subnet. How to accomplish this problem, I heard about static ARP table, but not interested to setup that kind of solution. I am thinking about nmap. Which can check against my database about valid Ethernet ID and Operating System being used. Anyone has done this kind of solution? > > -- > Stephen > > > --------------------------------- > Building a website is a piece of cake. > Yahoo! Small Business gives you all the tools to get online. > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" > > Make sure *net.link.ether.ipfw* is enabled, assuming it is since you said you had it partially working. Then use the following rules as a guidline : -- Outbound Rule -- allow ip from 172.16.100.50 to any MAC any 00:11:22:33:44:55 --Inbound Rule-- allow ip from any to 172.16.100.50 MAC 00:11:22:33:44:55 any Of course it seems your main concern is allowing people out that are indeed authorized, so you could likely make the inbound rule alot more general, something along the lines of : allow ip from any to 172.16.100.0/24 MAC any any Hope that helps! Chris Bowman
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?46DF7E94.8030208>