I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work:

iptables -A INPUT -i "eth0:0" -p tcp --destination-port 80 -j DROP

If I change eth0:0 to eth0 it works correctly. What is the problem?

  • 4
    I solved my question in this way: my interface was virtual so iptables couldn't access it, so I blocked the interface by my interface's IP not by interface's name my command is: iptables -A INPUT -p tcp --dport 80 -d {ETH0:0's IP} -j REJECT – sinoohe Dec 12 '11 at 8:58

The short story: the way you did that is correct (as per your comment to the question).

The long story: on Linux, a network ‘device’ called foo:bar is an alias of ‘foo’ used when we need to assign multiple network settings to the ‘foo’ interface, e.g. to have it respond on multiple subnets on the same wire.

This is a kludgy way of doing this, and inconsistent to boot. For IPv6, all the addresses assigned to the interface eth0 are listed together under the eth0 entry. There's a more modern method of doing this (via the ip addr command).

You can spot alias interfaces because they have a colon : in their names, the part to the left of the colon is an extant interface name, and the interface stanza when you do ifconfig is very short. The HWaddr should also be identical to that of the ‘parent’ interface. They also won't be listed in /proc/net/dev. If you were to say ip addr, eth0:0 would show as the second address of interface eth0. (look for the indented line starting with inet)

Aliases and their parents share a lot of the settings and fields, since they share the physical layer. The kernel doesn't treat them as entirely separate interfaces. For one, traffic appears on the parent interface, not the alias. You may have noticed the alias doesn't even have packet/byte counters!

If you need to sniff traffic, firewall, etc on an alias interface, you have to use its parent instead. Since the only difference an alias has from its parent is its IPv4 settings, the only way to match traffic on an alias is to use those IP settings. With iptables, you match the alias's IPv4 address just like you did in the comment to your answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.