Firewalling MAC addresses
-
Continuing the discussion on implementation challenges…
If pf does not support MAC based filtering then this, indeed, does present issues. However, I will point out that MAC based filtering, at the low-level, isn't necessarily required.
What is required, to support IPv6, is "MAC-specified" filtering. That is to say, the ability to specify the device or devices to be filtered by MAC address. This could then be dynamically translated into an equivalent IPv6 (e.g. using information from the NDP) before being pushed into pf. This would obviously require regular updates (perhaps driven from NDP updates). It would be roughly analogous to specifying hosts by URL or DNS name.
Of course, this would not be trivial, but it sounds a lot less problematic than trying to mix ipfw and pf rules.
Cheers,
Keith
-
I was quite surprised when I learned that the BSD iptables equivalent, pf, does not support L2 filtering. Until now I assumed this was possible the same way it is with iptables. However, I agree that there are some situations in which L2 filtering is helpful even though regular firewalls are supposed to work on L3. I've used MAC filters in the past with other firewalls and it worked as expected. In this thread it's the same as in others, people try to reason away the need for L2 filters on firewalls alltogether, but that does not solve the problem. People try to accomplish the same things with pfsense they have been doing with iptables for years, and that's completely legitimate.
I suggest to consider L2 MAC filtering a feature request for future releases of pfSense. To keep things easy, I would not mix L3/L2 in the firewall roules but rather suggest to implement a separate chain for MAC filters independent of the pf rules.
-
Hello,
I'm following up this thread.
Did someone find a way to block a MAC address (without IP reservation that will be easy to bypass ) ?Thanks
-
"(without IP reservation that will be easy to bypass ) ?"
So you think changing a mac address is difficult? Takes .2 seconds to set a different mac address.
-
"(without IP reservation that will be easy to bypass ) ?"
So you think changing a mac address is difficult? Takes .2 seconds to set a different mac address.
In fact, it's easier than changing the IP address, as you don't need to access pfSense, just the computer.
-
if your really worried you could always enable static arp.. Now someone trying to change and IP to get around a block would not be able to talk to pfsense from that different IP.
-
"(without IP reservation that will be easy to bypass ) ?"
So you think changing a mac address is difficult? Takes .2 seconds to set a different mac address.
I'm just saying that this is more easy for a basic user (99.9% of my customers) to change his IP than change his MAC address.
But I didn't want to debate on this because each situation and each need is different.Just wanted to know if someone finds a way to do that with pfSense.
-
99% of your users not going to know how to change even the IP ;) And very high percentage that do would prob know how to change the mac address as well.
If your concerned with such things going on, then use static arp to deal with it.
-
@Florent.a:
"(without IP reservation that will be easy to bypass ) ?"
So you think changing a mac address is difficult? Takes .2 seconds to set a different mac address.
I'm just saying that this is more easy for a basic user (99.9% of my customers) to change his IP than change his MAC address.
But I didn't want to debate on this because each situation and each need is different.Unless they work in an IT environment, I suspect most people wouldn't even know the difference between an IP and MAC address, let alone how to change them. I agree with johnpoz on this, map IP addresses to MACs in the DHCP server and use static ARP.
-
Sir,
If you have these problems, have you considered os10/onie environment? (Brtables?)
I have zero experience with oboe things but this would seem wise.
Sincerely,
magrw2066 -
if your really worried you could always enable static arp.. Now someone trying to change and IP to get around a block would not be able to talk to pfsense from that different IP.
How many get their IPv6 address via ARP? Not many. ;)
The world is moving to IPv6 and most devices will be using privacy addresses that change every day. Filtering outgoing traffic only on IPv6 address will not work. Bottom line, pfSense & pf will have to be updated to the 21st century, if it's to be able to filter outgoing traffic. As I mentioned before, people have to get out of the IPv4 mindset, as many things are different in IPv6. Also, crippling network functionality is not the solution to this problem, as others in this thread seem to think.
-
Umm my response seems lost.
Try ONIE boxes(not OBIE) and/or brtables command.
Sincerely,
Magrw2066 -
Just want to say. You guys might want to change this wikipedia page:
https://en.wikipedia.org/wiki/Comparison_of_firewalls
Since it states that pfsense has rules for blocking by mac address. It deceives people (like me) to think that pfsense can block by mac address. -
This is one feature that should definitely be added. IPtables has it, IIRC. With IPv6 privacy addresses changing daily, it's not possible to have an IPv6 address rule that would last longer than a day.
-
I notice the last response is 2mo old, but... I am using SonicWalls with MAC addresses being used in the rules all the time - for the very reasons that the OP listed, with IPv6 being the more annoying bit for me.
Filtering by IP is about as effective as milking a boar.
Since I've used pfSense for ages and the SonicWall bits are kinda new to me I had asked an engineer how the Sonicwall does this effectively with such an anemic CPU, and was told that the rules essentially are updated when the MAC goes live on the network with whatever IP(s) the machine has. The documentation I've read for the Sonicwalls I've been managing indicate that they operate very similarly to how pfSense does, aside from not being based on pf.
Since we have to record this information anyways and validate against DHCP/ARP, I'm not sure how-come pfSense can't do this? We're running CPUs that are worlds better than the junk in even the expensive Sonicwalls, so even if there was some overhead, I think it should be possible and even feasible. However I will digress in that I am not a programmer, and there may be some code sitting in the way that makes this incredibly expensive to do.
It sure as heck would make my life much easier. I could set things to happen based on MAC and not give a crap what IP they have or if they manually set it to something else, or if they're using IPv6 which as stated before by OP and here is ineffective.
-
All I can say is: Go Gary!!!!! You rock! Speaking from the year 2021 here, we have to deal with random macs now, so we should been on top of this problem when Gary first suggested we should! We “should have” had the ability by now to not give IP addresses to random Mac clients, just for example. OP GARY where you at???
-
@nick-wollman Why in the world are we resurrecting this thread...especially if you understand that MACs are randomized/spoofed...
-
@skogs good morning!
Honestly, I just wanted to congratulate Gary for pushing through all of the backlash he got. Wonderful, someone who knows what he wants and pushes to get it. I can relate, people just want to keep things the way they are. Or like to shut down honest question posters in the first reply.And now that I’m reminded, I just might have a solution that Gary is looking for, if he’s still around.
-
Rock on.
Deny by default works nicely. :) -
@chris4916 said in Firewalling MAC addresses:
What would be interesting, at least to me, is to understand why you would want to implement FW rules based on MAC address. This is something I don't understand yet.
easy answer : because devices may end up being assigned multiple IP addresses, a rule against the device's MAC address is a more "fixed" allocation
easy answer : because devices may end up being assigned multiple IP addresses, a rule against the device's MAC address is a more "fixed" allocation.
Plus it's nice to have options.
I am sure others would have additional use cases
Either way, it's a valid firewall parameter with the other big players (eg: CISCO, etc), so why not pfSense ?
