MAC filtering the internet traffic?

Question

I was trying to build a firewall where in the access to my LAN from internet should be allowed only if it matches the predefined MAC address of the device i.e,. MAC filtering, but later i found out that MAC filtering is not possible for the traffic coming from the internet, since it changes the MAC address of a packet for every hop(This is my understanding as far as i have read on the internet,please do correct me if I am wrong), please do suggest some alternative or solution, so that the traffic from only predefined MAC addresses are allowed to access the LAN. I tried experimenting with linux's utility iptables Any suggestions and corrections are greatly welcomed:-)

Answer 1

As others have already noted, filtering by MAC doesn't work because MAC addresses are not routable, only IP adresses are.

Filtering by MAC address wouldn't really work, anyway, because MAC addresses can be easily spoofed (changed). I can give my computer the same MAC address yours has, and as long as they're not on the same network segment, everything continues working just fine, except that if there was a way to look at the MAC address of a request in a routed network, I'd now look just like you.

What you can do is filter IP addresses by IP address block. There are services that provide geolocation services based on IP addresses; usually whole blocks of IP addresses are assigned to specific institutions. So you could in theory lock out anyone from china by blocking all IPs registered to chinese internet providers, chinese firms etc.

This won't be foolproof, however, because a) the geolocation lists are never perfectly accurate and perfectly up to date, and b) there are services such as proxies, VPNs and anonymization networks which can hide the actual origin IP of a request.

You'll have a bit more success if you whitelist IP blocks. For example, if you want people at your school to have access to your network service, but nobody else, you can whitelist the IP block assigned to your school.

But again, you should only consider this a first step. It also doesn't allow you to grant access to individual persons; IP addresses for the most part can't be reliably tied to people.

So if you really want to only allow specific persons / computers into your network, you'll have to secure it with an authentication and authorization step. For example, you could set up your own VPN and hand out access credentials to only those people whom you want to be able to access it.

Answer 2

EDIT

Abdul clarified that he needs to secure access to the home automation system in which only the intended user or authorize person can control.

In regards to that, you are going to want to use openSSH with key authentication. Key authentication is going to be exponentially more secure than password authentication. You will be generating public and private keys using RSA in which your intended user will hold his private key to authenticate. He will be the only to hold this private key. As you mentioned, IP address can change and so can MACs if they are spoofed so using RSA keys are going to be the solution to this. Research SSH and public and private key pairs.

Checkout this link: https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server

Unfortunately this is not going to be possible. MACs are used with a LAN and in the Layer 2 of the TCP/IP hybrid model. When internet comes into the picture you are now dealing with Layer 3 IP addresses. MAC filtering is only going to work within your own LAN.

With firewalls you are going to be looking at using ACLs (Access control lists) which is going to filter traffic based on IP(Layer 3) address.

When a packet is traveling through a network, at each hop the MAC destination and source will being changing but the IP source and destination will always stay the same. This is one reason MAC filtering is not going to work across the internet.

If you can provide a specific reason you are trying to do this then it could change things for example if the device is sitting on another LAN that you are in control of you can setup certain technologies to accomplish this.