allow by mac address

RouterOS Beginner Basics
1

Dear Sir’s

If we block a pc from internet with web-proxy (with its IP)
is it possible to allow iternet for it by mac address (from firewall filter)

thanks
Eng. Amgad

Re : allow lan/internet access by mac address only
2

There no one know how to deliver internet by mac address
or it is not possible

Please try to help me

3

I dont understand you question but basicly you can block or better allow certain clients by firewall rules identified either by IP address or MAC address. So there is a problem?

4

ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:92 action=accept (Allow User )
ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:93 action=accept (Allow User )
ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:94 action=accept (Allow User )
ip firewall filter add chain=input src-address=192.168.139.0/24 action=drop (all users deny)

Try this in same sequence

5

A great thanks to Mr. cyph3r

Yes it work

thanks again

Eng. Amgad

6

Its ok Bro

7

I want to add somthing else to his questions hoping somebody can help, accodring to cyph3r 's solution, how can I block all MACs and allow specific MACs without refering to ip address?

8

Qualify by something else, for example the interface traffic came in on.

ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:92 action=accept (Allow User )
ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:93 action=accept (Allow User )
ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:94 action=accept (Allow User )
ip firewall filter add chain=input src-address=192.168.139.0/24 action=drop (all users deny)

Turns into

ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:92 action=accept (Allow User )
ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:93 action=accept (Allow User )
ip firewall filter add chain=input src-mac-address=00:0C:29:32:E6:94 action=accept (Allow User )
ip firewall filter add chain=input in-interface=[name of customer interface] action=drop (all users deny)
9

Thanks! I will tring it

10

Works fine.

11

Hi,
It has been quite interesting. It was simply mind blowing, thanks for providing such a wonderful information.

12

Very useful post, but is there any way I can block a bunch of MAC Addresses in only one rule on the same way we can create IP-Address-List ? That will save a lot of CPU usage …
Tnx in advance

13

Hello

How can I create and use a MAC list as input for packet marking ? At prerouting /mangle I would like to use it.

Thanks in advance !