I try to connect from outside my network to my ssh server, but I want to restrict this connection only to my mac address
this rule work:
iptables -t mangle -A PREROUTING -p tcp --dport 22 -j ACCEPT
However none of this rules work for me:
iptables -t mangle -A PREROUTING -m mac --mac-source 2c:fd:a1:zz:xx:yy -p tcp --dport 22 -j ACCEPT
iptables -t nat -A PREROUTING -m mac --mac-source 2c:fd:a1:zz:xx:yy -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m mac --mac-source 2c:fd:a1:zz:xx:yy -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 2c:fd:a1:zz:xx:yy -p tcp --dport 22 -j ACCEPT
What should I do to protect ssh by mac validation?
PD: I know that SSH is a TCP/IP protocol, and only listen to an IP address, not a mac address, but I have read in some forums that it is possible to do it, but they do not explain the way. I also know that there are other ways to protect ssh, such as "port knocking", "keys instead of password", etc, etc., and that macs addresses can be falsified. But still I want to know how i can validate the entry by ssh using mac validation
A server/device can see only mac addresses of other devices in local network, but not devices behind a router.
So if one device can directly connect another - they see macs of each other. But if one device should go through a router to connect another device (not switch or wifi switch, but router facing your two devices using different network interfaces), they cannot see macs of each other.
a) In this case devices can see macs of each other
(device1) <---\
----- (switch or wifi point)
(device2) <---/
b) In this case (device1) can see only mac of (ISP router), not of (device 2)
(device1) <-----> (ISP router) <-----> (device2)
So based on macs you can configure who can connect to your wifi point, because it's about local network and direct connections.
But you have no ideas about macs of devices trying to come to your network from a remote location, in such scenarios knowing that remote devices macs is useless.
Does it make sense?
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments