Date: Tue, 11 Dec 2001 20:19:31 +0100 To: djweis@sjdjweis.com Subject: Proxy ARP with Linux (minor correction) Message-ID: <20011211201931.R25836@telegraafnet.nl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In http://www.sjdjweis.com/linux/proxyarp/index.html You say: You will need a 2.4 series kernel, the iproute2 utility, and a recent iptables userspace program. Allright, then these are my comments :) : Everything except for the iptables already work on a 2.2 kernel, there is nothing new there. Yes, I already used proxy-arp on a 2.2 kernel. Hmmm, ok, you are right that in this case you definitely need the connection tracking to prevent from unwanted garbage from entering your network, which is not the case in the classical (masquerading) firewalling approach. But that is the "only" reason to have 2.4... Another thing I am now busy to find out (I am not sure if this also works on 2.2, but I have no reason to believe it does not work): ip link set up dev eth0 ip addr add 127.0.0.1/32 dev eth0 echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp ip link set up dev eth1 ip addr add 127.0.0.1/32 dev eth1 echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp ip route add x.x.x.96/28 dev eth0 ip route add x.x.x.97/32 dev eth1 The theory behind it: the IP protocol driver needs to be bound to the device. This is done by giving any (bogus) ip address to an interface. Only after the IP protocol driver is bound to the interface you can use it for IP. /proc/sys/net/ipv4/conf will only show interfaces bound to the IP protocol... :) Of course: you cannot reach the firewall, and the firewall can't reach you. You need a non-bogus ip address for that... (Hmmmm: ssh 127.0.0.1 ... Hah! I hacked the firewall.... shutdown -h now ... Uh? ;) ) -- Telegraaf Elektronische Media http://wwwijzer.nl http://leerquoten.monster.org/ http://www.faqs.org/rfcs/rfc1855.html Let your government know you value your freedom. Sign the petition: http://petition.eurolinux.org/