netfilter and MAC filtering

I have a very simple problem to solve: I want only "valid" MAC addresses to come out of my eth0.

The reason is because I use vmware to run some Windows virtual machines. The host computer runs Etch. Each virtual machine have its own MAC addresse for each virtual network adapter. No problem here.

I just want nothing from the virtual machines go throught eth0. But throught tun0 or whatever is okay.

I first tested to just filter the virtual machine's IP with the following rule for netfilter:
iptables --table filter --append OUTPUT --out-interface eth0 --source $BAD_IP --protocol all --jump DROP
But some packets go throught eth0. I think this is because some packets don't have ip address in them (for example, packets to link IP and MAC addresses).

Well, okay. I then tested the following rule:
iptables --table filter --append FORWARD --out-interface eth0 --mac-source $BAD_MAC --jump DROP
and I get an error message. So bad.
---> iptables v1.3.6: Unknown arg `--mac-source'
The man page (man iptables, on the same computer) describe the --mac-source option.

1 - what the fxxk with --mac-source ?
2 - how can I tell Etch to block $BAD_MAC on eth0 ?