[LARTC] Proxy-ARP

[LARTC] Proxy-ARP

[S Mohan]

I'm working with LEAF boxes as gateway machines. I'm trying to implement
Proxy-ARP to build a bandwidth manager for my network. I've gone as per
the lartc howto to implement a transparent bridge in an existing network
and plan to put in my tc script after this. I'm configuring the box as a
standalone one before plugging it into the network. I'm getting an error
when I try to delete a route for local LAN addresses thro' the external
interface in order to put in a specific one to route only packets meant
for the router's interface thro' that ethernet interface on the LEAF
box. The kernel version is 2.4.18 patched with htb and ipsec. Iproute2
is also installed.

My intended network goes as below. I put up a LEAF box to try this. LAN
Config is as under

                         10.0.1.1
  Internet   +-----------------+      eth0+-----------+eth1      |
======> | Router/ VPN Box |----------|LEAF Bering|----------| LAN
  Leased     +-----------------+  10.0.1.4+-----------+10.0.1.4  |
10.0.1.x

I set up interfaces file and checked all the settings. I'm unable to
delete the route for eth0 for 10.0.1.x addresses. I'm giving below the
transcript. I'm not able to figure out what the problem is. Can you help
me put this up please?

<transcript>
#ip li sh
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop 
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:00:21:f3:0a:4f brd ff:ff:ff:ff:ff:ff
4: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:00:21:f4:50:e7 brd ff:ff:ff:ff:ff:ff

#ip addr sh
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop 
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:00:21:f3:0a:4f brd ff:ff:ff:ff:ff:ff
    inet 10.0.1.4/24 brd 10.0.1.255 scope global eth0
4: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:00:21:f4:50:e7 brd ff:ff:ff:ff:ff:ff
    inet 10.0.1.4/24 brd 10.0.1.255 scope global eth1

#ip ro sh
10.0.1.0/24 dev eth0  proto kernel  scope link  src 10.0.1.4 
10.0.1.0/24 dev eth1  proto kernel  scope link  src 10.0.1.4 
default via 10.0.1.1 dev eth0

#cat /proc/sys/net/ipv4/conf/eth1/proxy_arp
1

#cat /proc/sys/net/ipv4/conf/eth0/proxy_arp
1

#ip ro del 10.0.1.0/24 via 10.0.1.4 dev eth0
RTNETLINK answers: No such process

#ip ro add 10.0.1.1/24 via 10.0.1.4 dev eth0
#ip ro sh
10.0.1.1 via 10.0.1.4 dev eth0 
10.0.1.0/24 dev eth0  proto kernel  scope link  src 10.0.1.4 
10.0.1.0/24 dev eth1  proto kernel  scope link  src 10.0.1.4 
default via 10.0.1.1 dev eth0 
</transcript>

Since I'm going to be introducing this bridge into a production LAN, I'd
like this to work first shot. Any pointers please.

TIA
Mohan

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Proxy-ARP

[Martin A. Brown]

Mohan,

Let me note a few things.  First, you need only send a mail to the list, 
not the individual subscribers.  

Second,

  - you are either building a bridge

      OR

  - you are building a routing device which will divide the network in 
    two with proxy ARP

If you want to use a bridge, then see the archives for how to do 
traffic control with a bridge, and post specific questions.  I'd also
recommend reading up on bridging:

  http://www.tldp.org/HOWTO/BRIDGE-STP-HOWTO/index.html
  http://bridge.sourceforge.net/


If that's not what you want to do, try the proxy ARP mini-HOWTO, which 
will show you how to set up routes to each side of the network, and 
configure proxy ARP.

  http://www.tldp.org/HOWTO/mini/Proxy-ARP-Subnet/index.html

I've got a bit on it, as well, but you will probably find more complete 
instructions elsewhere.

  http://plorf.net/linux-ip/html/adv-proxy-arp.htm

Since what you have already started is a proxy ARP solution, I'll point 
some problems out.

 : #ip addr sh
 : 3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
 :     link/ether 00:00:21:f3:0a:4f brd ff:ff:ff:ff:ff:ff
 :     inet 10.0.1.4/24 brd 10.0.1.255 scope global eth0
 : 4: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
 :     link/ether 00:00:21:f4:50:e7 brd ff:ff:ff:ff:ff:ff
 :     inet 10.0.1.4/24 brd 10.0.1.255 scope global eth1

This means that you are assigning the same IP to two different ethernet 
interfaces on the same media segment.  That's not strictly forbidden, but 
unless you take some other steps, the machines on the ethernet will get 
one MAC address for 10.0.1.4 one some ARP requests, and the other MAC 
address for other requests.  That's not quite deterministic, so your 
networking will break.

Look into Julian's work on hidden ethernet interfaces if you really want 
to do this (I don't think you do).

  http://www.linuxvirtualserver.org/~julian/#hidden

 : #ip ro sh
 : 10.0.1.0/24 dev eth0  proto kernel  scope link  src 10.0.1.4 
 : 10.0.1.0/24 dev eth1  proto kernel  scope link  src 10.0.1.4 
 : default via 10.0.1.1 dev eth0

If you are intending to break the network into two pieces, you have not 
done so here.  You should make routes for the IPs which are reachable on 
each ethernet.  For example:

# ip route del 10.0.1.0/24 dev eth1
# ip route add 10.0.1.1 dev eth0
# ip route add default via 10.0.1.1

 : #ip ro del 10.0.1.0/24 via 10.0.1.4 dev eth0
 : RTNETLINK answers: No such process

That's because there is no such route....hence the answer is "RTNETLINK 
answers: No such process"  I'd suggest re-reading the iproute2 command 
reference to understand the use of the keyword "via".  You are not using 
the right keyword, or not understanding what you are asking of the kernel, 
here.

 : #ip ro add 10.0.1.1/24 via 10.0.1.4 dev eth0

Good luck,

-Martin

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

RE: [LARTC] Proxy-ARP

[S Mohan]

-----Original Message-----
From: Martin A. Brown
<snip>
Let me note a few things.  First, you need only send a mail to the list,
not the individual subscribers.
</snip>
Eager beaver. My apologies if I transgressed.

<snip>
This means that you are assigning the same IP to two different ethernet
interfaces on the same media segment.  That's not strictly forbidden, but
unless you take some other steps, the machines on the ethernet will get
one MAC address for 10.0.1.4 one some ARP requests, and the other MAC
address for other requests.  That's not quite deterministic, so your
networking will break.
</snip>
True. This is my intent. My LAN will get the MAC address of eth1 for
10.0.1.4 while my router will get the MAC address of eth1 for the same IP.
This is how it is physically arranged.

<snip>
If you are intending to break the network into two pieces, you have not
done so here.  You should make routes for the IPs which are reachable on
each ethernet.  For example:

# ip route del 10.0.1.0/24 dev eth1
# ip route add 10.0.1.1 dev eth0
# ip route add default via 10.0.1.1

 : #ip ro del 10.0.1.0/24 via 10.0.1.4 dev eth0
 : RTNETLINK answers: No such process

That's because there is no such route....hence the answer is "RTNETLINK
answers: No such process"  I'd suggest re-reading the iproute2 command
reference to understand the use of the keyword "via".  You are not using
the right keyword, or not understanding what you are asking of the kernel,
here.

 : #ip ro add 10.0.1.1/24 via 10.0.1.4 dev eth0
</snip>

I got my answer. Thanks. I guess I should have used "ip ro del 10.0.1.0/24
dev eth0". I used via as the scope link src was there. I wanted to get rid
of the generic route for 10.0.1.0/24 via eth0 and replace it with a route
for just 1 ip 10.0.1.1 (my router's ip) via eth0. Thus all packets meant for
my LAN will go thro' eth1 while those meant for the router will go thro'
eth0. I think I need to do a few more runs of the iproute2 doc to understand
syntax pretty well.

I was trying this so that I could use iptables for firewalling and
tc/cbq/htb for bandwidth shaping out of my LAN without reconfiguring and
gateway IPs on nodes. I was given to understand that a pure bridge will work
with iptables. Further reading has enlightened me on that too. Looks like
the bridging code now interfaces with iptables.

Thanks for the help.

Mohan

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/