Home » forums » Imported debian.org Mailing Lists » Debian Firewall

arp_proxy does not work with static DHCP/PERM arp ?

Tags:

Hello,
Yesterday after starting using arp_proxy i've received many lines like
this (in syslog) :

Sep 30 21:15:28 beta dhcpd: DHCPDISCOVER from 00:17:08:49:22:80 via eth1
Sep 30 21:15:28 beta dhcpd: DHCPOFFER on 10.100.1.21 to
00:17:08:49:22:80 via eth1
Sep 30 21:15:28 beta dhcpd: DHCPREQUEST for 10.100.1.21 (10.100.0.1)
from 00:17:08:49:22:80 via eth1
Sep 30 21:15:28 beta dhcpd: DHCPACK on 10.100.1.21 to 00:17:08:49:22:80 via eth1
Sep 30 21:15:29 beta dhcpd: DHCPDECLINE of 10.100.1.21 from
00:17:08:49:22:80 via eth1: not found

I have some DHCP net clients that are masqueraded and they are simply
put in dhcpd.conf like this :

host USERXXX { hardware ethernet 00:17:08:49:22:80; fixed-address
10.100.1.21; }

and with static MACaddr:

beta log # arp -an | grep 10.100.1.21
? (10.100.1.21) at 00:17:08:49:22:80 [ether] PERM on eth1

after switching:

net.ipv4.conf.all.proxy_arp = 0

to :

net.ipv4.conf.all.proxy_arp = 1

the above logs started to appear...

NAturally clients can't obtain IP address and don't have internet access.
What's wrong ? Can't I use proxy arp with static DHCP/static ARP ?
Why does my DHCP server decline to assign an IP address to a host
after makingh my router an arp_proxy ?

Here's arp fragment from my sysctl :

net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 1
net.ipv4.conf.eth1.arp_ignore = 0
net.ipv4.conf.eth1.arp_announce = 0
net.ipv4.conf.eth0.arp_ignore = 1
net.ipv4.conf.eth0.arp_announce = 1

p.s. eth1 -> lan
eth0 -> internet

--
Wojciech Ziniewicz
Unix SEX :{look;gawk;find;sed;talk;grep;touch;finger;find;fl
ex;unzip;head;tail; mount;workbone;fsck;yes;gasp;fsck;more;yes;yes;eje
ct;umount;makeclean; zip;split;done;exit:xargs!!;)}

--

Bookmark/Search this post with:
  • Delicious
  • Digg
  • StumbleUpon
  • Propeller
  • Reddit
  • Magnoliacom
  • Newsvine
  • Furl
  • Google
  • Yahoo
  • Technorati
0
‹ ehtsomyz PPPoE server performance / problem with uploads [long] ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

arp_proxy does not work with static DHCP/PERM arp ?

Submitted by Pascal Hambourg on Sun, 2007-09-30 16:00.

Hello,

Wojciech Ziniewicz a écrit :
> Yesterday after starting using arp_proxy i've received many lines like
> this (in syslog) :
>
> Sep 30 21:15:28 beta dhcpd: DHCPDISCOVER from 00:17:08:49:22:80 via eth1
> Sep 30 21:15:28 beta dhcpd: DHCPOFFER on 10.100.1.21 to
> 00:17:08:49:22:80 via eth1
> Sep 30 21:15:28 beta dhcpd: DHCPREQUEST for 10.100.1.21 (10.100.0.1)
> from 00:17:08:49:22:80 via eth1
> Sep 30 21:15:28 beta dhcpd: DHCPACK on 10.100.1.21 to 00:17:08:49:22:80 via eth1
> Sep 30 21:15:29 beta dhcpd: DHCPDECLINE of 10.100.1.21 from
> 00:17:08:49:22:80 via eth1: not found
[...]
> after switching:
>
> net.ipv4.conf.all.proxy_arp = 0
>
> to :
>
> net.ipv4.conf.all.proxy_arp = 1
>
> the above logs started to appear...
>
> NAturally clients can't obtain IP address and don't have internet access.
> What's wrong ? Can't I use proxy arp with static DHCP/static ARP ?
> Why does my DHCP server decline to assign an IP address to a host
> after makingh my router an arp_proxy ?

It's the client which declines the offered IP address, not the server.
My guess is that the client checks that the offered IP address is not
already in use by issuing an ARP request and expecting no reply. When
the router has proxy_arp enabled, it replies to the ARP request so the
client believes the IP address is in use and declines the offer.

You can check by running a packet sniffer on the client.

--

»

arp_proxy does not work with static DHCP/PERM arp ?

Submitted by Wojciech Ziniewicz on Sun, 2007-09-30 16:00.

2007/9/30, Pascal Hambourg :
> It's the client which declines the offered IP address, not the server.
> My guess is that the client checks that the offered IP address is not
> already in use by issuing an ARP request and expecting no reply. When
> the router has proxy_arp enabled, it replies to the ARP request so the
> client believes the IP address is in use and declines the offer.
>
> You can check by running a packet sniffer on the client.
>

It looks like You are right

What would you advice to get rid of this sittuation ?
I suppose that turning arp_proxy only on eth0 should work . It would be like :

net.ipv4.conf.eth0.proxy_arp = 1

regardz.

--
Wojciech Ziniewicz
Unix SEX :{look;gawk;find;sed;talk;grep;touch;finger;find;fl
ex;unzip;head;tail; mount;workbone;fsck;yes;gasp;fsck;more;yes;yes;eje
ct;umount;makeclean; zip;split;done;exit:xargs!!;)}

--

»

arp_proxy does not work with static DHCP/PERM arp ?

Submitted by Pascal Hambourg on Mon, 2007-10-01 04:00.

Wojciech Ziniewicz a écrit :
> 2007/9/30, Pascal Hambourg :
>
>>My guess is that the client checks that the offered IP address is not
>>already in use by issuing an ARP request and expecting no reply. When
>>the router has proxy_arp enabled, it replies to the ARP request so the
>>client believes the IP address is in use and declines the offer.
>
> It looks like You are right

However it is surprising that the router answers ARP requests for
addresses that are on the same side. This would not break only DHCP but
all ARP operation on the subnet.

> What would you advice to get rid of this sittuation ?
> I suppose that turning arp_proxy only on eth0 should work

I cannot give any advice without knowledge about your network layout, IP
subnets, routing tables, and what you need proxy ARP for.

--

»

arp_proxy does not work with static DHCP/PERM arp ?

Submitted by Wojciech Ziniewicz on Mon, 2007-10-01 12:00.

2007/10/1, Pascal Hambourg :
> However it is surprising that the router answers ARP requests for
> addresses that are on the same side. This would not break only DHCP but
> all ARP operation on the subnet.
>
> > What would you advice to get rid of this sittuation ?
> > I suppose that turning arp_proxy only on eth0 should work
>
> I cannot give any advice without knowledge about your network layout, IP
> subnets, routing tables, and what you need proxy ARP for.

It's simple . I've got 2 routers.
One that is a BGP peer with worldwide routing table that holds a C IP
class and has IP x.x.x.1
My router/firewall/TC machine is connected directly to the router with
x.x.x.2 IP .
It has 3 interfaces :
-eth0 for internet default via x.x.x.1
-eth1 for 10.0.x.x clients (DHCP assigned )
-eth2 for 10.0.x.x clients (pppoe-server assigned)

Actually 80% of the clients are masquaraded on x.x.x.2 but those who
have public IP addr are masqueraded also (DNAT/SNAT) so things like
active ftp don't work well .

I want to assign IP adressess directly to the interface of my clients
- i've been testing it for a while and it works - except for one
thing. After about 10 (?maybe less, maybe more?) minutes of
inactivity - there's no way to ping or connect to an IP addr from the
internet.

I think it has something to do with the way I assign IP adresses
statically through DHCP - my iptables and arp table are denying
customers to connect with another mac address .

So when I enable arp proxy on eth0 - there's everything OK - but AFAIK
i have to enable it on eth2 and eth1 and then clients get the
"DHCPDECLINE" message.

I can provide as much info as You want (and I'm able to ;) )
Regards.

Wojtek

--
Wojciech Ziniewicz
Unix SEX :{look;gawk;find;sed;talk;grep;touch;finger;find;fl
ex;unzip;head;tail; mount;workbone;fsck;yes;gasp;fsck;more;yes;yes;eje
ct;umount;makeclean; zip;split;done;exit:xargs!!;)}

--

»
Syndicate content