On Tue, 2010-04-27 at 07:58 +0100, Dr Andrew C Aitchison wrote:

> [ Don't forget that anyone with admin right on a machine can change the mac
>    address - see eg http://www.topbits.com/how-to-change-a-mac-address.html
> ]
> 


> iptables has options to allow packets based on the source mac address
> but, as I said, if the packet has been through a router since it left the 
> machine you wish to control then the address in the packet will not 
> belong to the machine you are interested in.

Another option is to restrict by netmask and to hard-code all the MAC
addresses in /etc/ethers, including dummy entires for any unused IP
addresses.

If you want real security buy a network access control device, $$.



John