You can apply zone protection to a virtual wire interface,
but because virtual wire interfaces don’t perform routing, you can’t
apply DoS Protection Against Flooding of New Sessions to
packets coming with a spoofed IP address, nor can you suppress ICMP
TTL Expired error packets or ICMP Frag Needed packets.