Script to filter any unwanted MACs on the outgoing port of a Hetzner server

hetzner-filter-macs.sh

#!/bin/sh
PHYS_IF="enp0s31f6"
MAIL_SERVER_MAC="00:50:56:00:B2:C4"
OPNSENSE_MAC="90:1b:0e:c4:42:26"

set -e 

echo "Initialize MAC filtering..."
echo "... physical interface is $PHYS_IF"

echo "... remove chains if present"
ebtables -D FORWARD -o $PHYS_IF -j phys_out_filter || true
ebtables -D OUTPUT -o $PHYS_IF -j phys_out_filter || true
ebtables -t filter -X phys_out_filter || true
echo "... create chain phys_out_filter"
ebtables -t filter -N phys_out_filter -P DROP || true
ebtables -F phys_out_filter || true
echo "... add MACs: $MAIL_SERVER_MAC"
ebtables -A phys_out_filter -s "$MAIL_SERVER_MAC" -j ACCEPT
echo "... add MACs: $OPNSENSE_MAC"
ebtables -A phys_out_filter -s "$OPNSENSE_MAC" -j ACCEPT

echo "... add FORWARD rule"
ebtables -A FORWARD -o $PHYS_IF -j phys_out_filter
echo "... add OUTPUT rule"
ebtables -A OUTPUT -o $PHYS_IF -j phys_out_filter