As far as i know, there is no way of distinguishing VLAN traffic in
iptables on the master interface (that is the interface to which virtual VLAN interfaces are added with vconfig or ip link add link; I don't know if that's the correct term, I encourage you to correct me).
In general that's no problem, as you can match using the virtual VLAN interface instead of the master interface, e.g.
iptables -A INPUT -i eth0.1 -p tcp -m tcp --dport 22 -j ACCEPT
This will allow TCP port 22 (SSH) packets arriving on
eth0.1, which are packets arriving on
eth0 tagged with VLAN-ID 1.
Problems arise, when you want to match only untagged traffic on the master interface, e.g.
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT
Our intend is to match TCP port 53 (DNS) packets arriving on eth0 without a VLAN tag, which we do, but we also match packets with any other VLAN-Tag arriving on
So a possibly workaround would be to include the IP address/subnet of the master interface in the rule. Let's assume we are using 10.0.0.0/24 on
eth0 and 10.0.1.0/24 on
iptables -A INPUT -i eth0 -d 10.0.0.0/24 -p tcp -m tcp --dport 53 -j ACCEPT
Unfortunately this has two drawbacks:
- We are also matching packets with bogus IP address, nothing stops malicious or misconfigured clients to send packets with 10.0.0.0/24 and VLAN-ID 1. In general that should not be an issue, because answers to that packet will take another route back and won't reach the original
- It does not work with broadcast traffic, like DHCP for example, which does not use the interface's IP address.
Especially the latter problem bothers me. For example the following has unwanted side effects:
iptables -A INPUT -i eth0 -p udp -m udp --dport 67 -j ACCEPT
This rule will match any incoming DHCP traffic on eth0, regardless which VLAN-tag a packet has on. If we want to exclude DHCP traffic with VLAN-ID 1, we are lost.