PF and MAC-Filtering ?

2007-01-29 Thread Frank Staals
I'm trying to get my FreeBSD gateway with PF firewall to only allow 
acces to my network and internet from a couple computers through MAC 
filtering. I couldn't realy find out what rules I should use; From the 
information I found on google I tried something like this but it seems 
that PF doesn't see the entrie(s) in my mac-table as a mac adres: ( only 
pasted the related rules ) :


block log

### Only allow WLAN connections from trusted Systems::
table wlanmacs persist file /usr/local/etc/pf/wlanmacs
pass in  on $wlanif from src wlanmacs to any keep state
pass out on $wlanif from any to src wlanmacs keep state

with in /usr/local/etc/pf/wlanmacs one Mac adres on each line; example:

00:0b:7b:23:33:25

As I said it doesn't seem that PF gets that it should treat the entries 
in the table as mac-adresses. How can I do that ? Or is there a better 
way to achieve the same result  ?


Regards,

--
-Frank Staals


___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: PF and MAC-Filtering ?

2007-01-29 Thread Philipp Wuensche
Frank Staals wrote:
 I'm trying to get my FreeBSD gateway with PF firewall to only allow
 acces to my network and internet from a couple computers through MAC
 filtering. I couldn't realy find out what rules I should use; From the
 information I found on google I tried something like this but it seems
 that PF doesn't see the entrie(s) in my mac-table as a mac adres: ( only
 pasted the related rules ) :
 
 block log
 
 ### Only allow WLAN connections from trusted Systems::
 table wlanmacs persist file /usr/local/etc/pf/wlanmacs
 pass in  on $wlanif from src wlanmacs to any keep state
 pass out on $wlanif from any to src wlanmacs keep state
 
 with in /usr/local/etc/pf/wlanmacs one Mac adres on each line; example:
 
 00:0b:7b:23:33:25
 
 As I said it doesn't seem that PF gets that it should treat the entries
 in the table as mac-adresses. How can I do that ? Or is there a better
 way to achieve the same result  ?

Just filter by ip-addr. on your gateway, it gives you the same level of
security as filtering by mac-addr. and configure your basestation to
only accept clients with mac-addr. you have allowed.

If you need some kind of authentication, take a look at authpf.

greetings,
philipp

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]