Re: Question about Proxyarp!

Tom Eastep
Fri, 06 Oct 2006 14:35:18 -0000

Ville Virtanen wrote:
> Hi,
>
> Still have some problems with multiple IP addresses. I''m thinking
of
> change one-to-one NAT to ProxyARP:
>

Don''t do it. Using Proxy ARP on a set of systems on a local LAN with
other
systems having RFC 1918 addresses is very tricky to get right. And it''s
a bad
idea, in my opinion.

Carefully follow Shorewall FAQ 2a and you should be able to get one-to-one NAT
working. And if you can''t, if you submit a problem report as described
at
http://www.shorewall.net/support.htm#Guidelines, we will try to get it working
for you.

> I''m not so experienced to configure bind to use views, so proxyarp
sounds
> much better.

Bind views are a much better solution. But frankly, the idea of having a bunch
of internet-accessible servers on the same LAN as Windows boxes scares me to
death. My best recommendation would be to put your servers on a separate LAN
segment.

-Tom
--
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key