Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 02 Aug 2007 15:51:44 +1000
From:      Danny Carroll <>
Subject:   IPFW Mac filter confusion.
Message-ID:  <>

Next in thread | Raw E-Mail | Index | Archive | Help

I am trying to deny traffic based on MAC address.
My freebsd (6.2) box is acting as a gateway.  The wireless clients
connect on ath0 and the wired network is connected on fxp0.  Default
route is vi fax0 to the internet gateway.

Arp table is:
freebsd# arp -a
? ( at 00:12:6f:11:22:25 on ath0 [ethernet]
? ( at 00:02:e2:d0:6b:a1 on fxp0 [ethernet] is the gateway and is the host I wish to prohibit.

Here are my rules.
freebsd# ipfw list
00050 deny ip from any to any MAC 00:12:6f:11:22:25 any
00050 deny ip from any to any MAC any 00:12:6f:11:22:25
65535 allow ip from any to any

If I add rules such as:
00050 deny ip from to any
00050 deny ip from any to

Then the firewall works as I would expect.

I think I must be misunderstanding how the MAC option to ipfw works.
The man page is not terribly helpful so I was wondering if someone can
enlighten me.


Want to link to this message? Use this URL: <>