I'm curious if anyone out there knows if it's possible to put together a bridging firewall in Linux or *BSD that can have a list of MAC addresses to permit through the bridge, and all others would be dropped. Actually, it would be preferable to be able to filter based on MAC address and by what ethernet port it came in on. I think most bridging firewall patches I've seen will only allow you to filter the bridge as one big chunk, rather than by interface, but I may be mistaken. Note that an ethernet bridge usually bypasses the TCP/IP stack (I think bridging works at a lower layer in the standard Taco Bell model than most filtering systems), so special patches would probably be required for it to work. At work, we need to be able to filter out some wireless traffic. The 802.11 bridges can supposedly do this, but there are several of them, and keeping the allowed addresses in sync could be a pain. Additionally, the wireless bridges we have only have a small amount of memory, so large tables could pose a problem. If worse comes to worse, I imagine we'll just have to carve out a new subnet. Filtering on an actual router appears to be much easier than on a bridge. -- _ _ _ _ _ ___ _ _ _ ___ _ _ __ Computer Lie #1: You'll / \/ \(_)| ' // ._\ / - \(_)/ ./| ' /(__ never use all that disk \_||_/|_||_|_\\___/ \_-_/|_|\__\|_|_\ __) space. [ Mike Hicks | http://umn.edu/~hick0088/ | mailto:hick0088 at tc.umn.edu ] -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 232 bytes Desc: not available Url : http://shadowknight.real-time.com/pipermail/tclug-list/attachments/20010607/736689d2/attachment.pgp