Shorewall users - Oct 2005 - Proxy Arp Troubleshooting problem

I''m trying to troubleshoot a problem I''m having with proxyarp.
I''ve
previously set up several proxyarp configurations which have worked
just fine, but this box seems to just swallow all inbound packets
destined for a proxyarped address.  Of course any suggestions on how
to fix this problem would be helpful, but also general suggestions on
how to go about troubleshooting proxyarp configurations because, as
I''m find out, its non-trivial.

ess:/tmp# shorewall version
2.0.3a
ess:/tmp# ip addr show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:30:48:73:02:1e brd ff:ff:ff:ff:ff:ff
    inet 70.250.28.140/25 brd 70.255.255.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:30:48:73:02:1f brd ff:ff:ff:ff:ff:ff
    inet 10.9.0.2/16 brd 10.0.0.255 scope global eth1
ess:/tmp# ip route show
70.250.28.240 dev eth1  scope link
70.250.28.243 dev eth1  scope link
70.250.28.242 dev eth1  scope link
70.250.28.128/25 dev eth0  proto kernel  scope link  src 70.250.28.140
10.101.0.0/16 via 10.9.0.252 dev eth1
10.103.0.0/16 via 10.9.0.252 dev eth1
10.5.0.0/16 via 10.9.0.254 dev eth1
10.102.0.0/16 via 10.9.0.252 dev eth1
10.43.0.0/16 via 10.9.0.252 dev eth1
10.8.0.0/16 via 10.9.0.252 dev eth1
10.41.0.0/16 via 10.9.0.252 dev eth1
10.9.0.0/16 dev eth1  proto kernel  scope link  src 10.9.0.2
default via 70.250.28.129 dev eth0

Gary Buckmaster wrote:
> I''m trying to troubleshoot a problem I''m having with
proxyarp.  I''ve
> previously set up several proxyarp configurations which have worked
> just fine, but this box seems to just swallow all inbound packets
> destined for a proxyarped address.  Of course any suggestions on how
> to fix this problem would be helpful, but also general suggestions on
> how to go about troubleshooting proxyarp configurations because, as
> I''m find out, its non-trivial.
> 
We handled this problem on IRC.

This turned out to be a stale ARP cache problem -- the Shorewall proxy
arp documentation already gives detailed information about how to
troubleshoot these problems.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key