# PF Question: Multiple IP addresses on a single interface



## freebsd number 1 (Sep 17, 2020)

Hello, i've got a question about configuring PF. I have an interface (vtnet0) that has 2 ip addresses assigned to it. I want to block incoming ICMP traffic to the second ip address (while permitting it to the first one). How can i do that?

I currently have the following rule in pf.conf which works fine for allowing icmp traffic on the second ip address while blocking it on the first one:


```
block on vtnet0 proto icmp from any to (vtnet0:0)
```

But how to do it the other way round?  I've tried to put in "(vtnet0:1)"  , but that results in an error about the syntax being incorrect.


----------



## mickey (Sep 18, 2020)

freebsd number 1 said:


> ```
> block on vtnet0 proto icmp from any to (vtnet0:0)
> ```
> But how to do it the other way round?  I've tried to put in "(vtnet0:1)"  , but that results in an error about the syntax being incorrect.


Unfortunately _:0_ is not an index into interface addresses but merely the name of the option to not include aliases, so there is no _:1_ - _:n_

```
:0            Do not include interface aliases.

           Host names may also have the :0 option appended to restrict the
           name resolution to the first of each v4 and v6 address found.
```
You'd have to specify the exact address instead, which could prove problematic if it is somehow dynamic.

Using the _quick_ option, you could use two rules. First one permits ICMP to the first address only, second rule blocks ICMP to any remaining addresses:

```
pass in quick on vtnet0 proto icmp to (vtnet0:0)
block in quick on vtnet0 proto icmp to (vtnet0)
```


----------

