I have an ASUS RT-AC68U router and would like to set up port forwarding, but I would like to restrict which MAC addresses can connect through that port.

My use case is that I'll have a live camera, and I want to connect to it remotely, but I only want myself and one other person to have access to it. Strong Username/Password are possible, but I want a layer of security on top of that, I want to limit it to pre-approved devices.

  1. Is this possible? If not, is there something else I can use, such as a MAC-restricted VPN?

  2. If it is possible, is it the best way to achieve this?

  • The MACs you want to permit are devices accessing the router remotely (i.e. not on the local network)?
    – schroeder
    May 6 '14 at 18:12

The issue you will have here has to do with L2 and L3 boundaries, and how MAC addresses are exposed.

When a L2 packet is handled by a L3 gateway, especially one which applies NAT to it, this will cause the packet to be re-transmitted by the l3 gateway rather than forwarded as is. This means that to the public world IE your remote location you will see the ASUS router as the sources and destination of the conversation, and the remote endpoint will not know what is behind the ASUS router. This is contrary to a L2 only network in which the logic is much simpler, the MAC address is compared with an ARP table, or list of ports and the MAC addresses associated with that port. The ARP table is populated by the conversations a network client makes when interrogating the network when first connected. The switches then effectively replicate the data packet and forward it to the destination port until it arrives.

The best you can do is restrict it to a remote IP, or you could layer on some security higher in the network stack, like in the session, or the application itself.

The problem with MAC addresses, is that they are readily forged. It's just security through obscurity because guessing which MAC to use wouldn't be trivial. Typically people use SSL keys or other harder to impersonate unique identifying mechanisms to ensure good security. For example, you could have a VPN which only allowed members to connect if they had a correct SSL private key which was authorized.

On a semi-related note - I highly recommend getting a Dropcam for watching a baby at home. It handles the security issue well and gives great HD quality.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.