Re: How do we arp for NAT? Secondary IPs, proxy arp? something else?

[Jesse Molina <jesse@opendreams.net>]

Just wanted to reply again for documentation purposes regarding this old 
thread.  This was EXACTLY what I was looking for.

Here are some sample commands to replicate this;

# Add the IP 1.2.3.4 to eth1
# sudo ip route add local 1.2.3.4 table local dev eth1
#
# Show the local table
# sudo ip route show table local
#
# Delete the IP 1.2.3.4 from eth1
# sudo ip route delete local 1.2.3.4 table local dev eth1



I have not observed any daemon or service using the IPs that I 
configured with this method for ephemeral (outbound) services.  My 
upstream packet accounting confirms this.

Yes, the system replies to ARP requests for these IPs.

Unfortunately, local daemons that glob onto all addresses are still 
answering to services on these IPs if you don't filter or re-direct the 
traffic via iptables DNAT/SNAT, but that's not a major issue since it 
can be controlled as mentioned here.



I have been using this for a couple of weeks, works great.  I recommend 
this procedure over using secondary IPs on regular interfaces.

I hope this is useful to someone in the future.



Pascal Hambourg wrote:
> Hello,
> 
> Jesse Molina a écrit :
>>
>> To restate my question:  What alternative ways are there to make the 
>> GNU/Linux system reply to ARP requests for an IP, without that IP 
>> being an actual interface on the host, or that interface must not be 
>> used by local services *in any way*, for the reasons of using it via 
>> SNAT/DNAT?
> 
> ip route add local <address>/<mask> table local dev <interface>
> 
> This way <address>/<mask> will be considered local by the system which 
> will reply to ARP requests for it, actually usable by any local process, 
> but won't appear assigned to <interface> so chances are that no local 
> process will use it unless told explicitly.
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

-- 
# Jesse Molina
# Mail = jesse@opendreams.net
# Page = page-jesse@opendreams.net
# Cell = 1.602.323.7608
# Web  = http://www.opendreams.net/jesse/