[LARTC] Proxy ARP considered harmful. :)

[Adrian Chung <adrian@enfusion-group.com>]

Here's my setup:

       .224 \
 
       .225  --- DSL Modem --- ISP (.252)

       .226 /

I've got a DSL modem that bridges ethernet between three boxes here,
and everything else on the same subnet at the ISP side.

With the three boxes plugged into a hub, with the DSL modem, I can't
do aggregate bandwidth shaping, because there's no way for one both to
know in relation to the other three how much bandwidth it's using.

I decided to use proxy-arp, and put two of the boxes behind a 2.4 box
doing shaping:

   .225 \
           -- .224 -- DSL Modem -- ISP (.252)
   .226 /

And, following the HOWTO, proceeded to turn proxy_arp on for the left
and right interface on .224 which both had IP address .224.

I set the routes up so that .225/6 went to the left, and .128/25 went
to the right.

Everything seemed to work fine.

Except that my box started to answer ARP requests from and for
everything on the ISP's .128/25 subnet.  So it caused lots of havoc.

The HOWTO assumes that you have a router of some sort between the
proxy ARP box and the ISP, so that ARP requests never traverse the
router.

In my case, since it's a bridge, everything goes.

So I'm now looking for a way to advertise the ARP addresses for .225
and .226 on the DSL modem (ISP facing side), without using proxy_arp.

I tried the following:

ip neigh add dev <dsl-modem-facing-if> proxy .225
ip neigh add dev <dsl-modem-facing-if> proxy .226

but the box doesn't answer ARP queries for those addresses.

If I do an:

ip addr add dev eth3 .225
arping -U -I eth3 -s .225 <some ISP address>
ip addr del dev eth3 .225

I can then ping <some ISP address> for what looks to be a short
(undetermined) time before they stop responding.  I'm assuming that my
ARP entry expires, and they no longer get a response to ARP probes for
.225 or .226.

Anyone have any idea what I can do?  I thought that "pub" ARP entries
were supposed to respond to ARP requests as long as the route doesn't
travel out the same interface the request came in on, but they don't
seem to.

Would kernel ARPd support and running userspace 'arpd' help me any?

Any ideas appreciated!

--
Adrian Chung (adrian at enfusion-group dot com)
http://www.enfusion-group.com/~adrian
GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17
[toad.enfusion-group.com] up 5 days, 4:00, 13 users

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/