martin, I apply this patch and set hidden =1,arp_filter =1 too, at all nic's but nothing changed. eth1 always reply that ip 10.0.0.2 is at eth1... It seems be so,that I can't forward packets over two different nic's which are in same network. bye >Roman, > ># echo 1 > /proc/sys/net/ipv4/conf/all/hidden ># echo 1 > /proc/sys/net/ipv4/conf/eth1/hidden ># echo 1 > /proc/sys/net/ipv4/conf/eth2/hidden > >If you don't have support for hidden in your kernel, visit Julian's page: > > http://www.linux-vs.org/~julian/ > http://www.linux-vs.org/~julian/#hidden > >This will prevent ethernet interfaces from responding for ARP for IPs >active on other devices. > >Good luck, > >-Martin > > : and when I ping from pc2 -> PC1:eth2, > : using tcpdump i see that PC1 > : send reply to (arp who has 10.0.0.2), > : 10.0.0.2 is at .....eth1. > : why PC1 send back not proper HW address? > : how I can force PC1 to say that 10.0.0.2 > : is at eth2? > : > : > : > : thanks in advance! > : > : > : > : > : > : _______________________________________________ > : LARTC mailing list / LARTC@mailman.ds9a.nl > : http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/ > : > > > -- Roman Virdzek - System & Network Engineering ____________________________________________ JARON INTERNET GmbH Hanauer Landstrasse 196a D-60314 Frankfurt am Main Fon:+49-69-405866-36 ; Fax:+49-69-405866-29 Internet: www.jaron.de ; www.popularix.de ____________________________________________ ( Saving Private Ryan... Private Ryan exists. Overwrite? (Y/N) )
Roman, : I apply this patch and set hidden =1,arp_filter =1 too, : at all nic's but nothing changed. eth1 always reply that : ip 10.0.0.2 is at eth1... : It seems be so,that I can't forward packets over two different : nic's which are in same network. Tarek was correct when he mentioned that you'll need to use policy routing in addition if both of the IPs you are using fall within the same network. # ip rule add from 10.0.0.2 lookup 2 # ip rule add from 10.0.0.1 lookup 1 # ip route add 10.0.0.0/24 dev eth1 src 10.0.0.1 # ip route add 10.0.0.0/24 dev eth2 src 10.0.0.2 Turn on the ARP hiding functionality: # echo 1 > /proc/sys/net/ipv4/conf/all/hidden You'll need to do this *after* you have brought up the interfaces and set the hidden flags explicitly. # echo 1 > /proc/sys/net/ipv4/conf/eth1/hidden # echo 1 > /proc/sys/net/ipv4/conf/eth2/hidden Good luck, -Martin : >Roman, : > : > : >If you don't have support for hidden in your kernel, visit Julian's page: : > : > http://www.linux-vs.org/~julian/ : > http://www.linux-vs.org/~julian/#hidden : > : >This will prevent ethernet interfaces from responding for ARP for IPs : >active on other devices. : > : >Good luck, : > : >-Martin : > : > : and when I ping from pc2 -> PC1:eth2, : > : using tcpdump i see that PC1 : > : send reply to (arp who has 10.0.0.2), : > : 10.0.0.2 is at .....eth1. : > : why PC1 send back not proper HW address? : > : how I can force PC1 to say that 10.0.0.2 : > : is at eth2? : > : : > : : > : : > : thanks in advance! : > : : > : : > : : > : : > : : > : _______________________________________________ : > : LARTC mailing list / LARTC@mailman.ds9a.nl : > : http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/ : > : : > : > : > : : : -- Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com
Sorry! Correction below: -Martin Tarek was correct when he mentioned that you'll need to use policy routing in addition if both of the IPs you are using fall within the same network. # ip rule add from 10.0.0.2 lookup 2 # ip rule add from 10.0.0.1 lookup 1 # ip route add 10.0.0.0/24 dev eth1 src 10.0.0.1 table 1 # ip route add 10.0.0.0/24 dev eth2 src 10.0.0.2 table 2 Turn on the ARP hiding functionality: # echo 1 > /proc/sys/net/ipv4/conf/all/hidden You'll need to do this *after* you have brought up the interfaces and set the hidden flags explicitly. # echo 1 > /proc/sys/net/ipv4/conf/eth1/hidden # echo 1 > /proc/sys/net/ipv4/conf/eth2/hidden -- Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com