Hi all! I wrote days ago: I have a problem with virutal interface and iptables: my pc has 2 network interface, one with a private network address and the other one with public network addresses: eth0 --> 192.168.1.254 / 255.255.255.0 eth1 --> 82.186.92.90 / 255.255.255.248 eth1:1 --> 82.186.92.91 / 255.255.255.248 eth1:2 --> 82.186.92.92 / 255.255.255.248 eth1:3 --> 82.186.92.93 / 255.255.255.248 eth1:4 --> 82.186.92.93 / 255.255.255.248 I have configured network with ifconfig and route iptables has this filter rules: *filter :FORWARD DROP [0:0] :INPUT DROP [0:0] :OUTPUT DROP [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -m state -i eth0 --state NEW -j ACCEPT -A INPUT -s 192.168.1.0 -i eth0 -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.90 --dport 22 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.90 --dport 80 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.90 --dport 143 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.90 --dport 10000 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.90 --dport 25 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.90 --dport 110 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.91 --dport 20 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.91 --dport 21 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.91 --dport 22 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1:1 -d 82.186.92.91 --dport 25 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.91 --dport 53 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.91 --dport 80 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.91 --dport 110 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.91 --dport 143 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.91 --dport 443 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.93 --dport 20 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.93 --dport 21 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.93 --dport 22 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.93 --dport 25 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.93 --dport 80 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.93 --dport 110 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.93 --dport 143 --state NEW -j ACCEPT -A INPUT -p tcp -m tcp -m state -i eth1 -d 82.186.92.93 --dport 8888 --state NEW -j ACCEPT as you can see I've tried changing configuration but anything changes: it is reported just a warning but the rule is not applied. -A INPUT -p tcp -m tcp -m state -i eth1:1 -d 82.186.92.91 --dport 25 --state NEW -j ACCEPT My pc is running Fedora core 2 and the kernel is 2.6.6 and I've just upgraded iptables to last release. The problem is that I can't access to services running at virtual interfaces. I tried to solve the problem as suggested me: I've seen that using alias is deprecated so I tried using iproute: I set up with ip addr add 82.186.92.90/24 brd 82.186.92.95 dev eth1 label eth1:0 ip addr add 82.186.92.91/24 brd 82.186.92.95 dev eth1 label eth1:1 ip addr add 82.186.92.92/24 brd 82.186.92.95 dev eth1 label eth1:2 ip addr add 82.186.92.93/24 brd 82.186.92.95 dev eth1 label eth1:3 ip addr add 82.186.92.94/24 brd 82.186.92.95 dev eth1 label eth1:4 but after service iptables restart anything changes, alias's rules doesn't be applied and no errors is reported. I think I'm doing something wrong with iproute but I don't know what: shoud I give any command to enable iproute? My problem is quite strange, I've never seen such.... tnks marco -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Conto Arancio. Zero spese, stessa banca, più interessi. Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=657&d=20040719
