mac config helper: sanewall-mac

5
sanewall-mac

sanewall-mac

ensure source IP and source MAC address match

        mac
        IP
        macaddr

## Description

Any `mac` commands will affect all traffic destined for the firewall host, or to be forwarded by the host. They must be declared before the first router or interface.

There is also a `mac` parameter which allows matching MAC addresses within individual rules (see rule-params).

The `mac` helper command DROPs traffic from any `IP` address that was not sent using the `macaddr` specified.

When packets are dropped, a log is produced with the label "MAC MISSMATCH" (sic.). `mac` obeys the default log limits (see logging in rule-params).

This command restricts an IP to a particular MAC address. The same MAC address is permitted send traffic with a different IP.

## Examples

    mac 192.0.2.1    00:01:01:00:00:e6
    mac 198.51.100.1 00:01:01:02:aa:e8

## See Also

- sanewall
- sanewall.conf
- rule-params