The short story: the way you did that is correct (as per your comment to the question).
The long story: on Linux, a network ‘device’ called
foo:bar is an alias of ‘foo’ used when we need to assign multiple network settings to the ‘foo’ interface, e.g. to have it respond on multiple subnets on the same wire.
This is a kludgy way of doing this, and inconsistent to boot. For IPv6, all the addresses assigned to the interface eth0 are listed together under the eth0 entry. There's a more modern method of doing this (via the
ip addr command).
You can spot alias interfaces because they have a colon
: in their names, the part to the left of the colon is an extant interface name, and the interface stanza when you do
ifconfig is very short. The
HWaddr should also be identical to that of the ‘parent’ interface. They also won't be listed in
/proc/net/dev. If you were to say
eth0:0 would show as the second address of interface
eth0. (look for the indented line starting with
Aliases and their parents share a lot of the settings and fields, since they share the physical layer. The kernel doesn't treat them as entirely separate interfaces. For one, traffic appears on the parent interface, not the alias. You may have noticed the alias doesn't even have packet/byte counters!
If you need to sniff traffic, firewall, etc on an alias interface, you have to use its parent instead. Since the only difference an alias has from its parent is its IPv4 settings, the only way to match traffic on an alias is to use those IP settings. With
iptables, you match the alias's IPv4 address just like you did in the comment to your answer.