Hack65.Protect Your Bridge with a Firewall

Hack 66. Filter MAC with HostAP and Madwifi

Filter MAC addresses before they associate with your Linux- powered access point .

While you can certainly perform MAC filtering at the link layer using iptables or ebtables [Hack #65] , it is far safer to let the HostAP or Madwifi drivers [Hack #63] do it for you. This not only blocks traffic that is destined for your network, but also prevents casual snoopers from even associating with your access point.

Both drivers are configured to do MAC filtering through the iwpriv command. The most useful way to filter MAC address is to make a list of wireless devices that you wish to allow, and then deny all others:

iwpriv wlan0 addmac 00:30:65:23:17:05
	iwpriv wlan0 addmac 00:40:96:aa:99:fd

	iwpriv wlan0 maccmd 1
	iwpriv wlan0 maccmd 4

The addmac directive adds a MAC address to the internal table. You can add as many MAC addresses as you like to the table by issuing more addmac commands. You then need to tell Host AP what to do with the table you've built. The maccmd 1 command tells Host AP to use the table as an allowed list, and to deny all other MAC addresses from associating. Finally, the maccmd 4 command boots off all associated clients , forcing them to reassociate.

Sometimes, you need to ban only a troublemaker or two, rather than set an explicit policy of permitted devices. If you need to ban a couple of specific MAC address but allow all others, try this:

iwpriv wlan0 addmac 00:30:65:fa:ca:de
	iwpriv wlan0 maccmd 2
	iwpriv wlan0 kickmac 00:30:65:fa:ca:de

As before, you can use addmac as many times as you like. The maccmd 2 command sets the policy to deny , and kickmac boots the specified MAC immediately, if it happens to be associated. This is probably nicer than booting everybody and making them re-associate just to ban one troublemaker. Incidentally, if you'd like to remove MAC filtering altogether, execute maccmd 0 .

If you make a mistake typing in a MAC address, you can use the delmac command just as you would addmac , and it (predictably) deletes the given MAC address from the table. Should you ever need to flush the current MAC table entirely but keep the current policy, use this command:

iwpriv wlan0 maccmd 3

Finally, if you are running HostAP, you can view the running MAC table by viewing the appropriate data in /proc :

cat /proc/net/hostap/wlan0/ap_control

The iwpriv program manipulates the running wireless driver, but doesn't preserve settings across reboots. Once you're happy with your MAC filtering table, be sure to put the relevant commands in an rc script to run at boot time.

Note that even unassociated clients can still listen to network traffic, so MAC filtering does little to prevent eavesdropping and MAC impersonation. To combat passive listening techniques (as done with Kismet in "Detect Networks with Kismet" [Hack #29] ), you will need to encrypt your wireless data. Use WPA [Hack #42] to protect your wireless network at the link layer.