Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work:

iptables -A INPUT -i "eth0:0" -p tcp --destination-port 80 -j DROP

If I change eth0:0 to eth0 it works correctly. What is the problem?

share|improve this question
3  
I solved my question in this way: my interface was virtual so iptables couldn't access it, so I blocked the interface by my interface's IP not by interface's name my command is: iptables -A INPUT -p tcp --dport 80 -d {ETH0:0's IP} -j REJECT –  sinoohe Dec 12 '11 at 8:58
add comment

1 Answer

up vote 3 down vote accepted

The short story: the way you did that is correct (as per your comment to the question).

The long story: on Linux, a network ‘device’ called foo:bar is an alias of ‘foo’ used when we need to assign multiple network settings to the ‘foo’ interface, e.g. to have it respond on multiple subnets on the same wire.

This is a kludgy way of doing this, and inconsistent to boot. For IPv6, all the addresses assigned to the interface eth0 are listed together under the eth0 entry. There's a more modern method of doing this (via the ip addr command).

You can spot alias interfaces because they have a colon : in their names, the part to the left of the colon is an extant interface name, and the interface stanza when you do ifconfig is very short. The HWaddr should also be identical to that of the ‘parent’ interface. They also won't be listed in /proc/net/dev. If you were to say ip addr, eth0:0 would show as the second address of interface eth0. (look for the indented line starting with inet)

Aliases and their parents share a lot of the settings and fields, since they share the physical layer. The kernel doesn't treat them as entirely separate interfaces. For one, traffic appears on the parent interface, not the alias. You may have noticed the alias doesn't even have packet/byte counters!

If you need to sniff traffic, firewall, etc on an alias interface, you have to use its parent instead. Since the only difference an alias has from its parent is its IPv4 settings, the only way to match traffic on an alias is to use those IP settings. With iptables, you match the alias's IPv4 address just like you did in the comment to your answer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.