Summary

Add support for masked MAC address matching in firewall rules via a mac-address-mask option, similar to the existing IP address mask functionality.

Motivation

VyOS currently supports arbitrary bitmask matching for IPv4 and IPv6 addresses. Extending the same capability to Ethernet MAC addresses would expose existing nftables functionality and enable a number of useful Layer 2 filtering scenarios without requiring raw nftables rules.

Proposed CLI

set firewall <family> <chain> rule <rule> destination mac-address 01:00:00:00:00:00
set firewall <family> <chain> rule <rule> destination mac-address-mask 01:00:00:00:00:00

Resulting in:

ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00

This example matches all multicast and broadcast destination MAC addresses.

Use Cases

• Match all multicast and broadcast MAC addresses using a single rule.
• Match vendor-specific MAC address prefixes (OUIs).
• Match arbitrary/discontiguous MAC address patterns, similar to Cisco ACL wildcard masks.
• Expose existing nftables functionality through the VyOS CLI instead of requiring custom nftables rules.

Implementation Notes

The feature is analogous to the existing IP address mask implementation and would simply emit nftables bitwise expressions for ether saddr and ether daddr. No kernel or nftables changes are required.