Gfilui

How do you multihome with netplan - bind multiple IPs to one network adapter?

I see several people have taken two different approaches to solve the problem -
One where both IPs are defined under the same device name as the nic which limits options with IPTables.

and

The other option is to create a vlan and point it to the nic.

Which is correct the correct way to do it and why was this changed in the first place. /etc/network/interfaces was simple, made sense, and obviously supported multi-homing.

Independent of netplan, it is best practice today to assign multiple addresses to a single interface rather than using interface aliases. The lack of clean support for this in /etc/network/interfaces is actually a matter of ifupdown showing its age.

Configuring multiple addresses on an interface is simple with netplan: https://netplan.io/examples#multiple-addresses-on-an-interface

To handle these addresses in iptables, you can use -s and -d options to specify the source and destination addresses to match, instead of using -i and -o options to distinguish by input or output interface. In the vast majority of cases this is equivalent. The one exception is if you have multiple aliases on the same interface configured with dynamic addresses, and want to apply different rules to traffic sent to each address; you can't configure the firewall rules before you know the destination address. But you also can't configure netplan to ask for dhcp multiple times on the same interface, so if you need this, you probably do have to use vlans.

You can minimize repetition of addresses in your iptables rules by using something like the following:

iptables -N eth0
iptables -N eth0_0
iptables -N eth0_1
iptables -A INPUT -i enp3s0 -d 192.168.1.5 -j eth0
iptables -A INPUT -i enp3s0 -d 192.168.1.6 -j eth0_0
iptables -A INPUT -i enp3s0 -d 192.168.1.7 -j eth0_1
iptables -A INPUT -i enp3s0 -j DROP
iptables -A eth0 [... eth0 rules here]
iptables -A eth0_0 [... eth0:0 rules here]
iptables -A eth0_1 [... eth0:1 rules here]