Search code examples
terminalraspberry-piwifimac-addressaccess-point

MAC Address Blocking/Filtering on Wifi Access Point using command line terminal

I am able to get Wifi connection in Raspberry Pi from wifi card acting as Access Point in Jatson Nano.
But now i want to continuously look into devices that are getting connected to Jatson Nano AP and kick off other than Raspberry Pi. If i assume, i know the MAC Address of Pi, is it possible to kick off any device that does not match that MAC Address?
Note : This AP is wifi card and not router, so do not have Settings Panel to filter MAC address and can only be done using terminal command by either ssh or some bash/python script
Is it possible to block/filter specific MAC Address using terminal?

Solution

  • You can try using iptables to filter by MAC address. Check out this answer.

    # Create the DHCP_clients chain in the 'raw' table
iptables -t raw -N DHCP_clients

# Incoming DHCP, pass to chain processing DHCP
iptables -t raw -A PREROUTING -p udp --dport 67 -j DHCP_clients

# Allowed DHCP clients
iptables -t raw -A DHCP_clients -m mac --mac-source <ALLOWED MAC> -j ACCEPT

# Deny other clients not listed above
iptables -t raw -A DHCP_clients -j DROP
    • Specify the raw table with -t.

    raw: This table is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target. It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or any other IP tables. It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes)

    -t, --table table
This option specifies the packet matching table which the command should operate on.
    • and create a new chain name to reference. 
    -N, --new-chain chain
Create a new user-defined chain by the given name. There must be no target of that name already.
    • the raw table provides PREROUTING(for packets arriving via any network interface), -A appends the rule to your chain.
    • DHCP uses ports 67 and 68 and the UDP protocol. You can prevent DHCP requests by blocking communication on these ports. 
    -A, --append chain rule-specification
Append one or more rules to the end of the selected chain.
    • then you have rules to ACCEPT only the MAC addresses you want and DROP all others.

    iptables manual