Configure arpfirewall with arptables in linux

There is a computer in the LAN that does not know whether it is an ARP virus or a software like P2P Terminator will launch an ARP attack on my host every five seconds .. This makes it amazing for me to access the Internet. You can use Kingsoft arpfirewall in WINDOWS. But in linux, it is still a little troublesome. After studying it, I finally finished it one night. The original author has already written in great detail. I added some comments. For the convenience of being the same as me... The red font is the command to be run on the terminal. The blue font is the display result on the terminal. The green font is the annotation added to me. The experts floated. Finally, I would like to thank the original author !!!

Original from http://ask.phpfans.net /? Do = show & id = 164893

1. Install arptables
The download page for arptables is: http://sourceforge.net/projects/ebtables/files/
0.0.3.3 download link: http://downloads.sourceforge.net/project/ebtables/arptables/arptables-v0.0.3/arptables-v0.0.3-3.tar.gz

Install the SDK after download:
Tar zxvf arptables-v0.0.3-3.tar.gz
Cd arptables-v0.0.3-3/
Make
Make install

The command is/usr/local/sbin/arptables,/usr/local/sbin/arptables-save,/usr/local/sbin/arptables-restore, system startup script/etc/rc. d/init. d/arptables. The configuration file read by this script must be stored in/etc/sysconfig/arptables. (This paragraph knows, and you don't need to perform any operations)

Open the arptables service:
Chkconfig arptables on

2. Configure arptables
Linux Server Gateway MAC is 00: 24: 51: E9: C7: 10, the same network segment another server 192.168.1.10 (host name is nh-blade-67) MAC address is 00: 17: A4: a8: 68: 11.

Configure the arpfirewall using the command line:
On eth0, if the source IP address is 192.168.1.10 and the source MAC address is not 00: 17: A4: A8: 68: 11, the data token is disabled.

/Usr/local/sbin/arptables-a input-I eth0 -- src-ip 192.168.1.10 -- src-mac! 00: 17: A4: A8: 68: 11-j DROP
(Replace 192.168.1.10 and 00: 17: A4: A8: 68: 11 with the ip address and mac address of another server in the same network segment. Note! There are spaces before and after)

On eth0, if the source MAC address is not 00: 24: 51: E9: C7: 10 (the MAC address of the gateway), the data scheme is disabled. This scheme is used to access the Internet.

/Usr/local/sbin/arptables-a input-I eth0 -- src-mac! 00: 24: 51: E9: C7: 10-j DROP
(Replace 00: 24: 51: E9: C7: 10 with the mac address of your gateway)

Note: The order of adding an arpfirewall policy cannot be incorrect. The statements for the gateway MAC address must be placed at the end. Otherwise, the access policy for the IP address in this segment cannot take effect.

Write the preceding policy to the configuration file:
/Usr/local/sbin/arptables-save>/etc/sysconfig/arptables

/Etc/sysconfig/arptables file content: (view method vi/etc/sysconfig/arptables)

* Filter
: INPUT ACCEPT
: OUTPUT ACCEPT
: FORWARD ACCEPT
-A input-j DROP-I eth0-o any-s nh-blade-67! -- Src-mac 00: 17: a4: a8: 68: 11
-A input-j DROP-I eth0-o any! -- Src-mac 00: 24: 51: e9: c7: 10

An error is prompted when you restart arptables by running the/etc/init. d/arptables restart command:

Stopping Arp filtering (arptables): [OK]
Starting Arp filtering (arptables): arptables v0.0.3-3: Can't use-o with INPUT

Try 'arptables-H' or 'arptables -- help' for more information.
ERROR (line 5 ):
[FAILED]

Modify the content after the/etc/sysconfig/arptables file:
(Vi/etc/sysconfig/arptables deletes-o any: wq is saved and exits)

* Filter
: INPUT ACCEPT
: OUTPUT ACCEPT
: FORWARD ACCEPT
-A input-j DROP-I eth0 any-s nh-blade-67! -- Src-mac 00: 17: a4: a8: 68: 11
/'

Then restart the arpfirewall. View the arpfirewall status/etc/init. d/arptables status:

* Filter
: INPUT ACCEPT
: OUTPUT ACCEPT
: FORWARD ACCEPT
-A input-j DROP-I eth0-o any-s nh-blade-67! -- Src-mac 00: 17: a4: a8: 68: 11
-A input-j DROP-I eth0-o any! -- Src-mac 00: 24: 51: e9: c7: 10

Note:
The version of arptables that comes with RHEL5U1 is 0.0.8. The -- source-ip parameter cannot be included in the command. This version is not released on sourceforge.net.

) Takes effect after restart
Enable: chkconfig arptables on
Close: chkconfig arptables off

2) takes effect immediately and becomes invalid after restart
Enable: service arptables start
Disable: service arptables stop