Re: firewall rules for subinterfaces

[Andre Correa <andre.correa@pobox.com>]

Hi, there is really no meaning on setting rules for subinterfaces, If 
you need to segment your network and can't plug new NICs look for VLANs. 
You can apply rules indicating VLAN interfaces (-i and -o) like this: 
eth0.100, eth0.200, etc...

Somebody correct me if I'm wrong but this was made possible under >= 2.6 
kernel versions, on 2.4.x you can't do it too.

Hope it helps.

Andre



Aleksandar Milivojevic wrote:
> Chris Verges wrote:
> 
>> Hey,
>>
>> Is there a way to add firewall rules for subinterfaces?  I'm
>> trying to do the equivalent of:
>>
>>   eth0   Intel Pro 10/100
>>     eth0:0   192.168.1.1
>>     eth0:1   192.168.2.1
>>
>>   iptables -A INPUT -p icmp -i eth0:0 -j DENY
>>   iptables -A INPUT -p icmp -i eth0:1 -j ACCEPT
> 
> 
> Nope you can't do that.  There's no point in doing it.  Just as you 
> added virtual interfaces to your firewall box, so can any node on your 
> network, effectively bypassing such firewall rules.  If you have a need 
> for such rules, than you really have a need for two separate physical 
> networks (otherwise, you are implementing security by obscurity, which 
> doesn't really work).
> 
> If all you wanted to do is to force clients to use specific IP address 
> on your firewall box, then do it by specifying destination IP address 
> ("-i eth0 -d 192.168.1.1 -j DROP" and "-i eth0 -d 192.168.2.1 -j 
> ACCEPT").  BTW, dropping all ICMP traffic might not be a good idea.
>