While IP-based filtering in iptables works well for static devices, it becomes problematic when dealing with mobile clients. When a laptop moves between networks, its public IP changes, breaking existing firewall rules. This creates maintenance overhead and connectivity issues.

The idea of filtering by MAC address appears logical at first glance - hardware addresses are unique identifiers that don't change with network location. However, there's a critical technical limitation:

# This WON'T work for remote devices:
iptables -A INPUT -p tcp --dport 5000 -m mac --mac-source 00:1A:2B:3C:4D:5E -j ACCEPT

MAC addresses only exist at Layer 2 of the OSI model and aren't routable across networks. They get replaced at every router hop, meaning your server will only see the MAC address of the last router, not the original client.

Since MAC filtering isn't viable for remote connections, consider these approaches:

VPN-Based Access Control

Set up a VPN where clients authenticate before accessing your server:

# Example OpenVPN configuration
client-config-dir /etc/openvpn/ccd
ifconfig-pool-persist /etc/openvpn/ipp.txt

Certificate-Based Authentication

Use SSL client certificates for TLS-enabled services:

# Nginx SSL client certificate configuration
ssl_client_certificate /etc/nginx/client_certs/ca.crt;
ssl_verify_client on;

Port Knocking

Implement a sequence-based access mechanism:

# Example knockd configuration
[options]
    UseSyslog

[openSSH]
    sequence    = 7000,8000,9000
    seq_timeout = 10
    command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    tcpflags    = syn

If your clients are on the same local network segment (no routers between them and your server), MAC filtering becomes possible:

# Local network MAC filtering example
iptables -A INPUT -p tcp --dport 5000 -m mac --mac-source 00:1A:2B:3C:4D:5E -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP

For remote access scenarios, combine multiple methods:

• VPN for secure tunnel
• Certificate authentication
• IP filtering on the VPN subnet
• Two-factor authentication

Here's a complete iptables example for a VPN-protected service:

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow VPN interface
iptables -A INPUT -i tun+ -j ACCEPT

# Allow SSH only from VPN
iptables -A INPUT -p tcp --dport 22 -s 10.8.0.0/24 -j ACCEPT

# Allow service port only from VPN
iptables -A INPUT -p tcp --dport 5000 -s 10.8.0.0/24 -j ACCEPT

# Drop everything else
iptables -A INPUT -j DROP

While IP-based firewall rules are common in iptables configurations, they pose significant limitations for roaming devices. When clients move between networks (home, office, coffee shops), their public IP changes, breaking existing IP-based access controls. This creates administrative overhead as you constantly need to update firewall rules.

MAC addresses (hardware addresses) remain constant regardless of network location. Filtering by MAC provides device-specific access control that persists across network changes. However, there's an important caveat...

MAC addresses only work at Layer 2 (Ethernet layer). When traffic crosses routers (like internet traffic), MAC addresses get replaced at each hop. This means standard MAC filtering won't work for remote connections.

For local networks, pure MAC filtering works:

# Allow specific MAC to access port 5000
iptables -A INPUT -p tcp --dport 5000 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT

For remote devices, we need a different approach:

When clients connect through VPN (like OpenVPN), their MAC becomes visible to your server:

# Example OpenVPN+iptables setup:
iptables -A INPUT -i tun+ -p tcp --dport 5000 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT
iptables -A INPUT -i tun+ -p tcp --dport 5000 -j DROP

Since MAC filtering has limitations, consider these alternatives:

# SSH example using certificates
Match User username
    CertificateFile /path/to/user-cert.pub

Remember that MAC addresses can be spoofed. For critical systems, combine MAC filtering with:

• VPN encryption
• Certificate authentication
• Rate limiting