Re: Firewall Rules by MAC Address. IS it possible?
Lee Sharp <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.m0n0wall |
|---|---|
| Message-ID | <[email protected]> |
On 09/29/2010 10:25 AM, James McKeand wrote: > Set the following rules on the LAN interface: > 1) Block source IP 1.1.1.1 port any to destination IP any port 80 (http) > 2) Block source IP 1.1.1.1 port any to destination IP any port 443 (https) > 3) Block source IP 1.1.1.1 port any to destination IP any port 8000 (Proxies per Lee) > > He would still be able to browse a web page at 1.1.1.2 because it is on the same subnet and will not go to the m0n0wall (i.e. the gateway of the 1.1.1.0 subnet). Also network browsing (i.e. Windows' - My Network Places) would still work - it is not http. > > Rules should be on LAN interface not WAN... You got it. A determined guy can still get out with VPN or something similer, but that will lock it down fairly tight. Lee