This is what I use on our routers, which are oldish PC's running Linux, to block a particular customer's MAC from our WAN:
Your current firewall configuration may be relevant. If there's a -j ACCEPT rule which matches before these rules, these will be skipped. IOW, these rules should come early.
It requires NETFILTER_XT_MATCH_MAC to be selected in your kernel. If it's compiled as a module, it must be loaded. It seems to fail silently otherwise, for some reason, which is weird since most other failures like this scream bloody murder.
Phones being rooted shouldn't make a difference since what you're configuring is your router, yes?
Last edited by Corona688; 02-27-2014 at 12:25 PM..
Generally, most people, I guess, go from 5.3 ML4 Directly to TL 7. So they may never run into this issue.
For the rest of us, here is the resolution of my problem in going from ML6 to TL7.
Apparently with the change from ML to TL IBM added a "BuildDate Verification" routine into... (1 Reply)
Hello,
I'm having problem with an iptables rule. It seems that on one of two systems on the nat table, the INPUT chain doesn't exist for some strange reason.
I get the error below:
# iptables -t nat -A INPUT -j ACCEPT
iptables: No chain/target/match by that name.
Here is my kernel on... (0 Replies)
Hi,
I am using below script to get the below given output. But i am wondering how to pick the names from below output.
Script:
echo "dis ql(*) cluster(CT.CL.RIBRSBT3)"| runmqsc CT.QM.701t8|egrep QUEUE|sed -e 's/QUEUE(/ /'|sed -e 's/)/ /'
Output:
... (10 Replies)
Hi, I am trying to permutate each column (Except for IDS).
file.txt
FID IID TOAST1 TOAST2 TOAST3
ID3 ID3 1 -9 2
ID4 ID4 2 1 1
ID1 ID1 -9 -9 1
ID8 ID8 1 1 -9
ID12 ID12 1 2 2
for toast1 column, there are two 1's, two 2's and one -9. Having the same number of denominations,... (2 Replies)
Hi all,
I have two doms on my machine. I boot my machine from an rfs in one dom1 and mount the other rfs in the other dom2 at /media. Now I wanted to restrict access of users on dom2 to only their home directories. I do not want them to access any other directories on dom1 or dom2. So I mounted... (2 Replies)
Hello,
This is really breaking my head. I request you help to solve this problem.
I have a list of files at the source directory (/tmp) as below,
NewTransfer_20131202_APAC.dat
NewTransferFile_20131202_APAC.dat
NewTransfer_20131203_APAC.dat
NewTransferFile_20131203_APAC.dat... (3 Replies)
Hi,
One of our old Digital Alpha Server has died (CPU Failure). I want to recover a file from that server. Backups were done via Networker, however, cross platform recovery is not supported and I don't have any other TRU64 server available.
Is there a VM or Emulator available which can get... (1 Reply)
Discussion started by: Mack1982
1 Replies
LEARN ABOUT LINUX
mac_bsdextended
MAC_BSDEXTENDED(4) BSD Kernel Interfaces Manual MAC_BSDEXTENDED(4)NAME
mac_bsdextended -- file system firewall policy
SYNOPSIS
To compile the file system firewall policy into your kernel, place the following lines in your kernel configuration file:
options MAC
options MAC_BSDEXTENDED
Alternately, to load the file system firewall policy module at boot time, place the following line in your kernel configuration file:
options MAC
and in loader.conf(5):
mac_bsdextended_load="YES"
DESCRIPTION
The mac_bsdextended security policy module provides an interface for the system administrator to impose mandatory rules regarding users and
some system objects. Rules are uploaded to the module (typically using ugidfw(8), or some other tool utilizing libugidfw(3)) where they are
stored internally and used to determine whether to allow or deny specific accesses (see ugidfw(8)).
IMPLEMENTATION NOTES
While the traditional mac(9) entry points are implemented, policy labels are not used; instead, access control decisions are made by iterat-
ing through the internal list of rules until a rule which denies the particular access is found, or the end of the list is reached. The
mac_bsdextended policy works similar to ipfw(8) or by using a first match semantic. This means that not all rules are applied, only the
first matched rule; thus if Rule A allows access and Rule B blocks access, Rule B will never be applied.
Sysctls
The following sysctls may be used to tweak the behavior of mac_bsdextended:
security.mac.bsdextended.enabled
Set to zero or one to toggle the policy off or on.
security.mac.bsdextended.rule_count
List the number of defined rules, the maximum rule count is current set at 256.
security.mac.bsdextended.rule_slots
List the number of rule slots currently being used.
security.mac.bsdextended.firstmatch_enabled
Toggle between the old all rules match functionality and the new first rule matches functionality. This is enabled by default.
security.mac.bsdextended.logging
Log all access violations via the AUTHPRIV syslog(3) facility.
security.mac.bsdextended.rules
Currently does nothing interesting.
SEE ALSO libugidfw(3), syslog(3), mac(4), mac_biba(4), mac_ifoff(4), mac_lomac(4), mac_mls(4), mac_none(4), mac_partition(4), mac_portacl(4),
mac_seeotheruids(4), mac_test(4), ipfw(8), ugidfw(8), mac(9)HISTORY
The mac_bsdextended policy module first appeared in FreeBSD 5.0 and was developed by the TrustedBSD Project.
The "match first case" and logging capabilities were later added by Tom Rhodes <trhodes@FreeBSD.org>.
AUTHORS
This software was contributed to the FreeBSD Project by NAI Labs, the Security Research Division of Network Associates Inc. under
DARPA/SPAWAR contract N66001-01-C-8035 (``CBOSS''), as part of the DARPA CHATS research program.
BSD May 21, 2005 BSD