Hi, there is really no meaning on setting rules for subinterfaces, If you need to segment your network and can't plug new NICs look for VLANs. You can apply rules indicating VLAN interfaces (-i and -o) like this: eth0.100, eth0.200, etc...
Somebody correct me if I'm wrong but this was made possible under >= 2.6 kernel versions, on 2.4.x you can't do it too.
Hope it helps.
Andre
Aleksandar Milivojevic wrote:
Chris Verges wrote:
Hey,
Is there a way to add firewall rules for subinterfaces? I'm trying to do the equivalent of:
eth0 Intel Pro 10/100 eth0:0 192.168.1.1 eth0:1 192.168.2.1
iptables -A INPUT -p icmp -i eth0:0 -j DENY iptables -A INPUT -p icmp -i eth0:1 -j ACCEPT
Nope you can't do that. There's no point in doing it. Just as you added virtual interfaces to your firewall box, so can any node on your network, effectively bypassing such firewall rules. If you have a need for such rules, than you really have a need for two separate physical networks (otherwise, you are implementing security by obscurity, which doesn't really work).
If all you wanted to do is to force clients to use specific IP address on your firewall box, then do it by specifying destination IP address ("-i eth0 -d 192.168.1.1 -j DROP" and "-i eth0 -d 192.168.2.1 -j ACCEPT"). BTW, dropping all ICMP traffic might not be a good idea.
