Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have 5 static IP addresses from our ISP:


On our firewall box, the NIC that is connected to our cable modem, appears to have all 5 IP addresses set on it. A previous IT guy set this thing up, and I'm not sure exactly what he did. Are these virtual interfaces on this NIC or what? Here is my ip addr output for that NIC:

rwd0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
    inet XXX.XXX.XXX.180/24 brd XXX.XXX.XXX.186 scope global rwd0
    inet XXX.XXX.XXX.181/29 brd XXX.XXX.XXX.186 scope global rwd0:FWB9
    inet XXX.XXX.XXX.182/29 brd XXX.XXX.XXX.186 scope global secondary rwd0:FWB10
    inet XXX.XXX.XXX.183/29 brd XXX.XXX.XXX.186 scope global secondary rwd0:FWB11
    inet XXX.XXX.XXX.184/29 brd XXX.XXX.XXX.186 scope global secondary rwd0:FWB12
    inet6 fe80::250:8bff:fe61:5734/64 scope link 
       valid_lft forever preferred_lft forever

I'm a bit new to firewalls and networking so I'm just trying to figure out what he had going on here. I know he used Firewall Builder to configure the iptables rules, maybe that has something to do with the "FWB" I see in those names?

So my questions are:

  1. What is going on here? Virtual Interfaces? Or something else?

  2. If we want to put in a second firewall in parallel with this firewall but we only want it to handle traffic to XXX.XXX.XXX.182, how do we get rid of the static XXX.XXX.XXX.182 address on this existing firewall box?

The firewall is running on Fedora 11 (yes I know, not the best choice, hence the reason I'm looking into replacing the firewall and also an example of the reason the previous IT guy no longer works here).

share|improve this question
up vote 3 down vote accepted

probably not the best answer, but generic one - you can always do:

cd /etc
grep -R  XXX\.XXX\.XXX\.182 .

this will give you ide in which file in /etc [ where usually - in sane setups - this sort of information lives ] this ip shows up - this will be good place to start your investigations.

share|improve this answer

Fedora has it's own network configuration in /etc/sysconfig/network-scripts. Files with IP configuration are named ifcfg-'name_of_interface', for your setup probably ifcfg-rwd0, ifcfg-rwd0:FWB9, etc..

If you want to have another router parallel to this one, removing ifcfg-rwd0:x should be sufficant. And you need to add these IPs to the second router/fw, ofcourse.

share|improve this answer

Yes they are virtual interfaces, the normal naming scheme is ethX:Y. X being the main interface and Y being a subinterface identifier. Usually you will see eth0:0, eth0:1, etc.

In this case it looks like your main interface is called rwd0 and the rwd0:FWB[9-12] are subinterfaces.

Your guess of them being setup by firewall builder is very reasonable.

As far as why this was done, you need to alias all of your public IPs on the firewall that you want to offer services on for machines behind the firewall. Say you had 2 webservers and you wanted to host them both on standard 80. If you only had one ip, say your .180, you couldn't do it, you'd could only send port 80 to one machine behind the firewall. With multiple addresses you can say traffic targeted at .180:80 goes to webserver1 while .181:80 goes to webserver2.

Haven't personally dealt with Fedora or Firewall Builder so I can't tell you the specific location for the file to edit, but some usual suspects are: /etc/sysconfig /etc/conf.d /etc/network

Basically, look around in etc and you will find it.

share|improve this answer
Actually it is technically possible to have two web servers behind one IP address using a reverse proxy. That doesn't work for all services though. – Matt May 10 '10 at 21:29
The point was you can only send the traffic from the firewall to one place per ip/port combo, yes that place could be a device that then determines which webserver to send it to, but unless you need that for load balancing, I bet getting an extra IP address is going to be way cheaper. Webserver was just an example, could be mail, ftp, ssh, etc. – ManiacZX May 10 '10 at 23:43

Well it looks like they are secondary IPs:

[kbrandt@kbrandt: ~/scrap/] sudo ifconfig eth0:0 netmask
[kbrandt@kbrandt: ~/scrap/] ip addr show eth0   
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 100
    link/ether 00:19:d1:03:39:a5 brd ff:ff:ff:ff:ff:ff
    inet brd scope global eth0
    inet brd scope global eth0:0
    inet6 fe80::219:d1ff:fe03:39a5/64 scope link 
       valid_lft forever preferred_lft forever

However, I can't say why the previous admin assigned them to the firewall itself, I also don't know what a rwd device is I'm afraid.

To remove it would be something like:

 sudo ip addr del dev eth0

For my case, but like I said I don't recognize the rwd device, so proceed with caution.

Oh, RaLink wireless interface is rwd? in this case just replace my eth0 example with rwd0.

Edit 2:
This actually just to show Maniac what I am talking about:
Machine 1:

$ sudo iptables -t nat -L -b 
Chain PREROUTING (policy ACCEPT 14 packets, 1431 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  554 46536 DNAT       all  --  any    any     anywhere            to: 

Chain POSTROUTING (policy ACCEPT 823 packets, 72596 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    3   600 SNAT       all  --  any    any         anywhere            to: 

Chain OUTPUT (policy ACCEPT 823 packets, 72944 bytes)
 pkts bytes target     prot opt in     out     source               destination

eth0      Link encap:Ethernet  HWaddr 00:21:9b:1d:4c:7d  
          inet addr:  Bcast:  Mask:

eth0:0    Link encap:Ethernet  HWaddr 00:21:9b:1d:4c:7d  
          inet addr:  Bcast:  Mask:

Machine 2:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface UGH   0      0        0 eth0   U     1      0        0 eth0     U     1000   0        0 eth0         UG    0      0        0 eth0

$ ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.604 ms
64 bytes from icmp_seq=2 ttl=64 time=0.629 ms

And then tcp dump confirms the pings go where I think they go...

share|improve this answer
You assign them to the firewall so you can expose services behind the firewall targeted at those addresses. Also if you want to make different groups of machines going outbound use different IPs (say, your users get .180 and your mail server gets .181 to lower the chance of your mail server IP getting blacklisted from malware activities). – ManiacZX May 10 '10 at 20:56
I don't see why you would need to do that, as long as the packets get there and you have the SNAT and DNAT you should be good. So for instance if you public IP is As long as the hop away from you have route gw you should be able to NAT to and from even if it isn't assigned. I could be wrong, I have never tested this in production with Linux, but that is how I do my Ciscos. And this setup using virtual interfaces seems to work fine on my desktop. – Kyle Brandt May 10 '10 at 21:46
We use SmoothWall and the IPs are aliased on the firewall's red interface when we have multiple public IPs. I don't see how it would work without. How would the ISPs router know to send the traffic to the firewall otherwise. Like you said, firewall public, that means it's gateway is say and you have a second IP of you want the firewall to port forward to a server inside. If the firewall isn't running as an alias, how does know to talk to the firewall for that traffic? – ManiacZX May 10 '10 at 23:51
ManiacZX: The neighbor router knows because it has an entry in the routing table like I described. For example via It then knows to to send any packets destined to will be sent to the interface with the IP of – Kyle Brandt May 11 '10 at 0:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.