I have a vm on which I'm trying to configure (unsuccessfully) one service per physical device - i.e. ssh open only on eth0, http only on eth1 and ftp only on eth2. This has to happen regardless on the physical device configuration so for example it has to work if eth0,eth1 and eth2 are all using DHCP on the same subnet as well as in the case eth0 is on one, eth1 using DHCP on another, etc.
The first try was to use the device (-i eth0) to filter out the traffic in iptables however it turns out due to how the kernel operates ssh will become open on eth1 and eth2 as well (packets are accepted on interface with a different IP). Switching to use IP filtering (-s x.y.z.q) does not work properly because the tables need to be updated every time the DHCP info changes.
I'm open to any suggestions on how to get this going, I've tried NAT-ing to a virtual interface which has static IP, bridges, etc all without any success.
UPDATE1: I did not mention but by using the IP (-s x.y.z.q) and setting arp_filter to 2 (RFC3704 Loose Reverse Path) I get one service per device however I need to keep the firewall in sync with the actual IPs of the devices and that has proven to be really finicky.