Jtdylktuy

There is a cyberoam router.
A firewall rule exits which drops all services from specific host.

Now the problem is if I specify the host as "IP host" and enter the source ip of particular node.
The node is unable to access Internet as expected.

But if i specify the host as "MAC Host " and enter the MAC address of same Node.
The node is still able to access the Internet. Any Suggestions why?

If u need i can also upload a image showing the configuration of the rule

Well, that's strange. This is how I do it in the company that I work for and it works just fine ...

Check the settings under basic Settings in the Cyberoam Rules editor:

Basic settings:
Zone Source: LAN

Zone dest. : WAN

Network/Host Source : MAC_address

Network/Host Destination : "Any IP Address"

Services : "Any Services"

Schedule : "All the time"

Action : "Drop"

Of course we have the cyberoam in between our internet router and our internal network.

The MAC address is only used on the local network. If you're filtering on the WAN (Internet) side, local MAC addresses are not relevant.

The hardware destination address of all regular packets received on the WAN link is the router's MAC address on the WAN link. The hardware source address off all regular packets sent over the WAN link is the router's MAC address on the WAN link.

That's even assuming the WAN link uses MAC addresses. If it doesn't, then the concept of MAC addresses doesn't even apply to the WAN side.