Can I do the following and is there a nice script to generate the firewall rules for it? for interface eth0: assign ip and run dns service on it only. disallow all else accept ssh from particular source. for eth0:1 ... n: assigne separate ip and run httpd, and afew others on it. basically rules for eth0:1 .. n are not the same as for eth0 or more generally be able to create and manage rules for each sub-interface.