3

I was trying to build a firewall where in the access to my LAN from internet should be allowed only if it matches the predefined MAC address of the device i.e,. MAC filtering, but later i found out that MAC filtering is not possible for the traffic coming from the internet, since it changes the MAC address of a packet for every hop(This is my understanding as far as i have read on the internet,please do correct me if I am wrong), please do suggest some alternative or solution, so that the traffic from only predefined MAC addresses are allowed to access the LAN. I tried experimenting with linux's utility iptables Any suggestions and corrections are greatly welcomed:-)

  • As you already figured out, the MAC address of your computer doesn't travel beyond your home router. Therefore you can't filter incoming Internet traffic this way. – Arminius Mar 12 '17 at 6:09
3

As others have already noted, filtering by MAC doesn't work because MAC addresses are not routable, only IP adresses are.

Filtering by MAC address wouldn't really work, anyway, because MAC addresses can be easily spoofed (changed). I can give my computer the same MAC address yours has, and as long as they're not on the same network segment, everything continues working just fine, except that if there was a way to look at the MAC address of a request in a routed network, I'd now look just like you.

What you can do is filter IP addresses by IP address block. There are services that provide geolocation services based on IP addresses; usually whole blocks of IP addresses are assigned to specific institutions. So you could in theory lock out anyone from china by blocking all IPs registered to chinese internet providers, chinese firms etc.

This won't be foolproof, however, because a) the geolocation lists are never perfectly accurate and perfectly up to date, and b) there are services such as proxies, VPNs and anonymization networks which can hide the actual origin IP of a request.

You'll have a bit more success if you whitelist IP blocks. For example, if you want people at your school to have access to your network service, but nobody else, you can whitelist the IP block assigned to your school.

But again, you should only consider this a first step. It also doesn't allow you to grant access to individual persons; IP addresses for the most part can't be reliably tied to people.

So if you really want to only allow specific persons / computers into your network, you'll have to secure it with an authentication and authorization step. For example, you could set up your own VPN and hand out access credentials to only those people whom you want to be able to access it.

  • As you said setting up a VPN would resolve the issue,since the public ip address will be dynamic what will be the solution for this! – Abdul Mar 12 '17 at 17:14
  • There are a number of services on the internet which let you associate a domain name with a dynamic ip address. Dyn (formerly DynDNS) started out providing such a service. – Pascal Mar 12 '17 at 17:35
1

EDIT

Abdul clarified that he needs to secure access to the home automation system in which only the intended user or authorize person can control.

In regards to that, you are going to want to use openSSH with key authentication. Key authentication is going to be exponentially more secure than password authentication. You will be generating public and private keys using RSA in which your intended user will hold his private key to authenticate. He will be the only to hold this private key. As you mentioned, IP address can change and so can MACs if they are spoofed so using RSA keys are going to be the solution to this. Research SSH and public and private key pairs.

Checkout this link: https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server

Unfortunately this is not going to be possible. MACs are used with a LAN and in the Layer 2 of the TCP/IP hybrid model. When internet comes into the picture you are now dealing with Layer 3 IP addresses. MAC filtering is only going to work within your own LAN.

With firewalls you are going to be looking at using ACLs (Access control lists) which is going to filter traffic based on IP(Layer 3) address.

When a packet is traveling through a network, at each hop the MAC destination and source will being changing but the IP source and destination will always stay the same. This is one reason MAC filtering is not going to work across the internet.

If you can provide a specific reason you are trying to do this then it could change things for example if the device is sitting on another LAN that you are in control of you can setup certain technologies to accomplish this.

  • Thanks a lot for replying! let me make it clear, I am working on my final sem project, which is to secure the path and prevent illegitimate access to the home automation system, where in only the intended user such as the home owner /any other authorized person can control the home appliances from the internet when they are away from home or not within the wifi limits to access to home automation system. If iam not wrong ACLs will work only when the IP address is static, if iam trying to access the system from internet then the IP will be dynamic right? – Abdul Mar 12 '17 at 8:55
  • @Abdul I have edited my answer above, let me know how this solution works for you – nd510 Mar 12 '17 at 16:19
  • Ok! i did little research on what openssh is & found out that the client initiates a request and the server will respond to it and the secure connection is established! In my case the client will be the owner who is trying to access the home automation system from the internet, to make this happen i should install openssh on my home server,since the public ip address i get will be dynamic(i will be using the port forwarding mechanism to access specific devices on the home network), how do i tackle this issue and make sure that the client reaches the correct home automation system everytime! – Abdul Mar 12 '17 at 17:09
  • @Abdul a home owner can request a static ip address from m their ISP provider or this seems to be another solution: superuser.com/questions/317812/… – nd510 Mar 12 '17 at 17:21
  • thanks a lot for helping me in understanding this concept, i would opt for static ip address in order to obtain effective control of home automation system...once again thanks for your time :-) – Abdul Mar 15 '17 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.