From mboxrd@z Thu Jan 1 00:00:00 1970 From: Adrian Chung Date: Sat, 23 Feb 2002 04:11:44 +0000 Subject: [LARTC] Proxy ARP considered harmful. :) Message-Id: List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org Here's my setup: .224 \ .225 --- DSL Modem --- ISP (.252) .226 / I've got a DSL modem that bridges ethernet between three boxes here, and everything else on the same subnet at the ISP side. With the three boxes plugged into a hub, with the DSL modem, I can't do aggregate bandwidth shaping, because there's no way for one both to know in relation to the other three how much bandwidth it's using. I decided to use proxy-arp, and put two of the boxes behind a 2.4 box doing shaping: .225 \ -- .224 -- DSL Modem -- ISP (.252) .226 / And, following the HOWTO, proceeded to turn proxy_arp on for the left and right interface on .224 which both had IP address .224. I set the routes up so that .225/6 went to the left, and .128/25 went to the right. Everything seemed to work fine. Except that my box started to answer ARP requests from and for everything on the ISP's .128/25 subnet. So it caused lots of havoc. The HOWTO assumes that you have a router of some sort between the proxy ARP box and the ISP, so that ARP requests never traverse the router. In my case, since it's a bridge, everything goes. So I'm now looking for a way to advertise the ARP addresses for .225 and .226 on the DSL modem (ISP facing side), without using proxy_arp. I tried the following: ip neigh add dev proxy .225 ip neigh add dev proxy .226 but the box doesn't answer ARP queries for those addresses. If I do an: ip addr add dev eth3 .225 arping -U -I eth3 -s .225 ip addr del dev eth3 .225 I can then ping for what looks to be a short (undetermined) time before they stop responding. I'm assuming that my ARP entry expires, and they no longer get a response to ARP probes for .225 or .226. Anyone have any idea what I can do? I thought that "pub" ARP entries were supposed to respond to ARP requests as long as the route doesn't travel out the same interface the request came in on, but they don't seem to. Would kernel ARPd support and running userspace 'arpd' help me any? Any ideas appreciated! -- Adrian Chung (adrian at enfusion-group dot com) http://www.enfusion-group.com/~adrian GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17 [toad.enfusion-group.com] up 5 days, 4:00, 13 users _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/