On Sun, 2004-07-18 at 05:52, Yaron Presente wrote: > Hi All, > I have a linux box (Montavista 2.4.18), which is connected to the > external world through an IP subnet A. > I want to DNAT this subnet A to a private subnet B, and to do this I > need to support proxy arp for hosts in class A, which don't actually exist. > My problems are all ARP related: > 1. I want to reply on ARP requests for hosts on subnet A. looking at the > arp code in net/ipv4/arp.c, it seems that > this should have been the default behaviour (i.e > (rt->rt_flags&RTCF_DNAT) behaves the same as if a proxy arp was defined > on the interface). However, testing shows that the linux doesn't reply. > why ? > 2. To overcome the first problem, I can enable proxy arp explicitly. > However, proxy arp does not answer to requests if the > routing lookup shows that the target is located on the incoming > interface of the request. any ideas? > 3. If there are real hosts of subnet A on my external interface, I do > not want to serve as proxy arp for them. > is there a way to define these exceptions to the proxy arp? can I set a > big proxy_delay in /proc and hope that the real host would > answer before my proxy? > Any help would be appreciated. > Thanks, > Yaron If I understand you correctly, it is a pretty straightforward DNAT with exactly the proxy ARP issues you describe. I typically handle this by binding the DNAT address to the public NIC using iproute2. For example, if I NAT 10.1.1.5 to 1.1.1.5, I have the appropriate DNAT rule in iptables and then do a ip address add 1.1.1.5/24 brd + dev eth0 or whatever parameters are appropriate. I'm not sure if the brd + is necessary if I already have an address for the same subnet bound to the NIC. Perhaps someone else can comment. Once ISCS is available (http://iscs.sourceforge.net), it will automatically handle the ARP configuration when you assign a public address to a private host. In fact, that code works now along with almost all the access control portion. Good luck with it - John -- Open Source Development Corporation Financially sustainable open source development http://www.opensourcedevelopmentcorp.com
