I have a small VPN setup where I use IP tables to nat traffic coming in the vpn0 interface to the IP address of the eth0 interface. These rules look like this:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A FORWARD -i vpn0 -j ACCEPT
The device that has this configuration gets plugged into many different network subnets and its IP address is usually obtained dynamically. I run a lot of host discovery scans using nmap accross this connection and would like to drop traffic coming in on the vpn0 interface that is destined for whichever IP address is configured on the eth0 interface to keep my results accurate without having to worry about manually omitting the vpn host. Since this device is routing traffic, I can't just use the destination interface as the destination as this would block all my forward traffic.
I know iptables supports hostnames as destinations, so I may end up trying to dynamically add a rule once the IP address is obtained and create a hostname that will resolve to the eth0 IP address. However, this seems pretty messy.
Is there a better way that I'm missing?