Hey,
Is there a way to add firewall rules for subinterfaces? I'm trying to do the equivalent of:
eth0 Intel Pro 10/100 eth0:0 192.168.1.1 eth0:1 192.168.2.1
iptables -A INPUT -p icmp -i eth0:0 -j DENY iptables -A INPUT -p icmp -i eth0:1 -j ACCEPT
Nope you can't do that. There's no point in doing it. Just as you added virtual interfaces to your firewall box, so can any node on your network, effectively bypassing such firewall rules. If you have a need for such rules, than you really have a need for two separate physical networks (otherwise, you are implementing security by obscurity, which doesn't really work).
If all you wanted to do is to force clients to use specific IP address on your firewall box, then do it by specifying destination IP address ("-i eth0 -d 192.168.1.1 -j DROP" and "-i eth0 -d 192.168.2.1 -j ACCEPT"). BTW, dropping all ICMP traffic might not be a good idea.
-- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
