Is it possible to hook a packet after NF_IP_POST_ROUTING step of Netfilter?

Question

I think that detection of source/destination mac addresses of a packet is done after NF_IP_POST_ROUTING step of Netfilter. Is it possible to hook the packet after this step with correct mac addrs? I want to decide about the out-going packet from my NIC to another to drop/accept packet. In another way, it is like to a firewall rule on mac addresses of output packets .

Answer 1

NO.

At the step of NF_IP_POST_ROUTING, the packet is still not filled up with mac address.

You can add some kernel packet sniffer job.

Here is a simple introduction.