Re: Proxy ARP NetNS Awareness

[Nicolas Dichtel <nicolas.dichtel@6wind.com>]

Le 17/10/2025 à 08:56, Household Cang a écrit :
> Last light the Linux Librechat was focused on digging the kernel code surrounding /net/ipv4/arp.c and /net/core/net_namespace.c to answer whether the proxy_arp feature enabled by sysctl is namespace aware.
> 
> After many hours of tracing from namespace-generating unshare --net command all the way to the kernel net_namespace.c gave us some clues that the main ns and new ns converged at arp_net_init() in arp.c. And I am currently stuck on this line 1497
> 
> proc_create_net("arp", 0444, net->proc_net, &arp_seq_ops,
>             sizeof(struct neigh_seq_state))
> 
> It is unknown whether this function creates a "view" to the ARP neighbor table such that each netns has a different view to the neighbor table, OR each netns maintains its own neighbor table. Either way, the implication is whether proxy_arp enabled by sysctl is restricted to the current netns.
Each netns maintains its own neighbor tables.
The sysctl proxy_arp is per netns.

Nicolas

> 
> If proxy_arp is retricted to the current netns, then the Debian documentation on wireless bridge-less pseudo-bridge https://wiki.debian.org/BridgeNetworkConnections may be wrong in insinuating that the proxy_arp feature in the modern kernel can replace parprouted userspace program.
> 
> The current documentation with sysctl net-related options are really vague in terms of netns interaction. arp_ignore, arp_announce, arp_filter did not do a good job of disambiguating whether any of these arp features can or cannot work across namespaces, or the reasons for the behavior.
> 
> From the arp_filter option description, this line "IP addresses are owned by the complete host on Linux, not by particular interfaces." is a single-netns statement, but highly suggests that arp operations are per namespace.
> 
> When a virtual ethernet pair is created between two netns, parprouted userspace program can relay arps across namespaces, but the kernel proxy_arp cannot.
> 
> Thank you for any insights and feel free to forward to subject matter experts.
> I really want to get to the bottom of this.
> 
> Lucas
>