Re: [LARTC] Proxy ARP considered harmful. :)

[bert hubert <ahu@ds9a.nl>]

On Fri, Feb 22, 2002 at 11:11:44PM -0500, Adrian Chung wrote:
> Here's my setup:
> 
>        .224 \
>  
>        .225  --- DSL Modem --- ISP (.252)
> 
>        .226 /
> 
> I've got a DSL modem that bridges ethernet between three boxes here,
> and everything else on the same subnet at the ISP side.
> 
> With the three boxes plugged into a hub, with the DSL modem, I can't
> do aggregate bandwidth shaping, because there's no way for one both to
> know in relation to the other three how much bandwidth it's using.
> 
> I decided to use proxy-arp, and put two of the boxes behind a 2.4 box
> doing shaping:
> 
>    .225 \
>            -- .224 -- DSL Modem -- ISP (.252)
>    .226 /
> 
> And, following the HOWTO, proceeded to turn proxy_arp on for the left
> and right interface on .224 which both had IP address .224.
> 
> I set the routes up so that .225/6 went to the left, and .128/25 went
> to the right.
> 
> Everything seemed to work fine.
> 
> Except that my box started to answer ARP requests from and for
> everything on the ISP's .128/25 subnet.  So it caused lots of havoc.

Proxy ARP does require that you 'know' what's on the left and on the right
of your interface. Hosts on the left shouldn't be asking for hosts on the
internet, they should be asking for the default gw.

> The HOWTO assumes that you have a router of some sort between the
> proxy ARP box and the ISP, so that ARP requests never traverse the
> router.

If an ARP traverses the router, it's not a router, but a bridge :-)

> In my case, since it's a bridge, everything goes.

Indeed.

> So I'm now looking for a way to advertise the ARP addresses for .225
> and .226 on the DSL modem (ISP facing side), without using proxy_arp.

I think you can tell a route to be public or not, so you could have routes
for which no ARPs are sent out, even though proxy arp is on. Check the ip
documentation (it't a TeX file that is mentioned in the HOWTO somewhere).

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/