Just wanted to reply again for documentation purposes regarding this old
thread. This was EXACTLY what I was looking for.
Here are some sample commands to replicate this;
# Add the IP 1.2.3.4 to eth1
# sudo ip route add local 1.2.3.4 table local dev eth1
#
# Show the local table
# sudo ip route show table local
#
# Delete the IP 1.2.3.4 from eth1
# sudo ip route delete local 1.2.3.4 table local dev eth1
I have not observed any daemon or service using the IPs that I
configured with this method for ephemeral (outbound) services. My
upstream packet accounting confirms this.
Yes, the system replies to ARP requests for these IPs.
Unfortunately, local daemons that glob onto all addresses are still
answering to services on these IPs if you don't filter or re-direct the
traffic via iptables DNAT/SNAT, but that's not a major issue since it
can be controlled as mentioned here.
I have been using this for a couple of weeks, works great. I recommend
this procedure over using secondary IPs on regular interfaces.
I hope this is useful to someone in the future.
Pascal Hambourg wrote:
Hello,
Jesse Molina a écrit :
To restate my question: What alternative ways are there to make the
GNU/Linux system reply to ARP requests for an IP, without that IP
being an actual interface on the host, or that interface must not be
used by local services *in any way*, for the reasons of using it via
SNAT/DNAT?
ip route add local <address>/<mask> table local dev <interface>
This way <address>/<mask> will be considered local by the system which
will reply to ARP requests for it, actually usable by any local process,
but won't appear assigned to <interface> so chances are that no local
process will use it unless told explicitly.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
# Jesse Molina
# Mail = jesse@xxxxxxxxxxxxxx
# Page = page-jesse@xxxxxxxxxxxxxx
# Cell = 1.602.323.7608
# Web = http://www.opendreams.net/jesse/
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
