Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two servers that uses ucarp as failover. On each server eth1:1 is reserved for ucarp's keepalive connection.

ucarp uses the destination IP as multicast address

On ucarp master server is eth1:1's IP and on the secondary serve is eth1:1's IP


I would like to make an iptables rule on each server, so these NIC's are not used by anyone by mistake. I.e. drop everything expect for ucarp.

How would such a rule look like for the master server?

I assume something like this?

iptables -P INPUT -i eth1:1 -j DROP
iptables -A INPUT -i eth1:1  ? something with multicast ?  -j ACCEPT
share|improve this question
up vote 5 down vote accepted
iptables -A INPUT -i eth1:1 -m pkttype --pkt-type multicast -j ACCEPT

Make sure that the xt_pkttype module is loaded into the running kernel:

--- Networking support        
      Networking options  --->
          [*] Network packet filtering framework (Netfilter)  --->
              Core Netfilter Configuration  --->
                  <*>   "pkttype" packet type match support
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.