How do you multihome with netplan - bind multiple IPs to one network adapter?

I see several people have taken two different approaches to solve the problem - One where both IPs are defined under the same device name as the nic which limits options with IPTables.

and

The other option is to create a vlan and point it to the nic.

Which is correct the correct way to do it and why was this changed in the first place. /etc/network/interfaces was simple, made sense, and obviously supported multi-homing.

  • Can you clarify how you see defining multiple ips on a single device as limiting iptables? Attaching multiple IPs to a single interface is current best practice, not just in netplan but in Linux networking generally (interface aliases are broadly deprecated, and I've never heard of using a vlan this way); so it would be good to understand what problems you're seeing with this in order to best address your question. – slangasek Apr 13 at 22:58
  • with the new netplan method you lose the ability to make custom rules in IPTABLEs that can refrence eth0, eth0:0, eth0:1 as three different adapters with three different rules as far the interface is concerned. You can make rules that match the different IPs but you cannot fine tune the rules to pay attention to aliased interface name (eth0:1) only the parent interface eth0. – Charles Jordan Apr 14 at 1:45

Independent of netplan, it is best practice today to assign multiple addresses to a single interface rather than using interface aliases. The lack of clean support for this in /etc/network/interfaces is actually a matter of ifupdown showing its age.

Configuring multiple addresses on an interface is simple with netplan: https://netplan.io/examples#multiple-addresses-on-an-interface

To handle these addresses in iptables, you can use -s and -d options to specify the source and destination addresses to match, instead of using -i and -o options to distinguish by input or output interface. In the vast majority of cases this is equivalent. The one exception is if you have multiple aliases on the same interface configured with dynamic addresses, and want to apply different rules to traffic sent to each address; you can't configure the firewall rules before you know the destination address. But you also can't configure netplan to ask for dhcp multiple times on the same interface, so if you need this, you probably do have to use vlans.

You can minimize repetition of addresses in your iptables rules by using something like the following:

iptables -N eth0
iptables -N eth0_0
iptables -N eth0_1
iptables -A INPUT -i enp3s0 -d 192.168.1.5 -j eth0
iptables -A INPUT -i enp3s0 -d 192.168.1.6 -j eth0_0
iptables -A INPUT -i enp3s0 -d 192.168.1.7 -j eth0_1
iptables -A INPUT -i enp3s0 -j DROP
iptables -A eth0 [... eth0 rules here]
iptables -A eth0_0 [... eth0:0 rules here]
iptables -A eth0_1 [... eth0:1 rules here]

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.