> Hello, > > Justin Booth wrote: > > > ARPING 192.168.3.1 from 192.168.2.1 eth0 > > Unicast reply from 192.168.3.1 [00:E0:81:03:42:B9] 0.671ms > > > The MAC address listed is the mac addess of eth0 of box B. It seems like > > someone could use arping to do local network discovery of attached > > multi-homed networks... Ultimatly I would like to stop box B from replying > > that it has 192.168.3.1, to keep my attached private networks from being > > discovered. I've tried enableing the following in sysctl with no avail > > I assume you want to block the IP traffic too. Can this > work both for ARP and IP?: > Actually I need to have the ip traffic for the 192.168.2.0/24 network, I just don't want the 192.162.2.0/24 network to be able to find the 192.168.3.0/24 network. Consider the 192.168.2.0 network to be a network where most of my company sits, on the 192.168.3.0 network is our sensitive accounting network..... I need to be able to talk to both sides, and not have the 192.168.2.0/24 network be able to discover the 192.168.3.0/24 network. > # subnet 192.168.3.0/24 does not like 192.168.2.0/24: > ip rule add prio 100 from 192.168.3.0/24 to 192.168.2.0/24 blackhole > > # make the above to happen > echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter > echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter I tried this anyway and got the response of : RTNETLINK answers: Invalid argument Justin Booth - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
