2

How do you multihome with netplan - bind multiple IPs to one network adapter?

I see several people have taken two different approaches to solve the problem - One where both IPs are defined under the same device name as the nic which limits options with IPTables.

and

The other option is to create a vlan and point it to the nic.

Which is correct the correct way to do it and why was this changed in the first place. /etc/network/interfaces was simple, made sense, and obviously supported multi-homing.

Improve this question
2
  • Can you clarify how you see defining multiple ips on a single device as limiting iptables? Attaching multiple IPs to a single interface is current best practice, not just in netplan but in Linux networking generally (interface aliases are broadly deprecated, and I've never heard of using a vlan this way); so it would be good to understand what problems you're seeing with this in order to best address your question.
    – slangasek
    Apr 13, 2018 at 22:58
  • with the new netplan method you lose the ability to make custom rules in IPTABLEs that can refrence eth0, eth0:0, eth0:1 as three different adapters with three different rules as far the interface is concerned. You can make rules that match the different IPs but you cannot fine tune the rules to pay attention to aliased interface name (eth0:1) only the parent interface eth0.
    – Charles Jordan
    Apr 14, 2018 at 1:45

1 Answer 1

Reset to default
1

Independent of netplan, it is best practice today to assign multiple addresses to a single interface rather than using interface aliases. The lack of clean support for this in /etc/network/interfaces is actually a matter of ifupdown showing its age.

Configuring multiple addresses on an interface is simple with netplan: https://netplan.io/examples#multiple-addresses-on-an-interface

To handle these addresses in iptables, you can use -s and -d options to specify the source and destination addresses to match, instead of using -i and -o options to distinguish by input or output interface. In the vast majority of cases this is equivalent. The one exception is if you have multiple aliases on the same interface configured with dynamic addresses, and want to apply different rules to traffic sent to each address; you can't configure the firewall rules before you know the destination address. But you also can't configure netplan to ask for dhcp multiple times on the same interface, so if you need this, you probably do have to use vlans.

You can minimize repetition of addresses in your iptables rules by using something like the following:

iptables -N eth0
iptables -N eth0_0
iptables -N eth0_1
iptables -A INPUT -i enp3s0 -d 192.168.1.5 -j eth0
iptables -A INPUT -i enp3s0 -d 192.168.1.6 -j eth0_0
iptables -A INPUT -i enp3s0 -d 192.168.1.7 -j eth0_1
iptables -A INPUT -i enp3s0 -j DROP
iptables -A eth0 [... eth0 rules here]
iptables -A eth0_0 [... eth0:0 rules here]
iptables -A eth0_1 [... eth0:1 rules here]
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.