2.2. Proxy ARP

最新推荐文章于 2025-09-20 21:54:34 发布

转载最新推荐文章于 2025-09-20 21:54:34 发布 · 441 阅读

文章标签：

#network #interface #query #layer

转《Guide To IP Layer Network Administration With Linux Version 0.4.4》专栏收录该内容

48 篇文章

订阅专栏

本文介绍了ProxyARP技术及其在网络隔离和安全防护中的应用。通过代理ARP，可以实现不同网段主机间的通信控制，同时也能用于限制单一IP网络内两台主机之间的暴露。文章详细解释了设备如何响应ARP查询，并对比了包过滤桥接与执行代理ARP的防火墙之间的差异。

2.2. Proxy ARP

Occasionally, an IP network must be split into separate segments. Proxy ARP can be used for increased control over packets exchanged between two hosts or to limit exposure between two hosts in a single IP network. The technique of proxy ARP is commonly used to interpose a device with higher layer functionality between two other hosts. From a practical standpoint, there is little difference between the functions of a packet-filtering bridge and a firewall performing proxy ARP. The manner by which the interposed device receives the packets, however, is tremendously different.

Example 2.10. Proxy ARP Network Diagram

The device performing proxy ARP (masq-gw) responds for all ARP queries on behalf of IPs reachable on interfaces other than the interface on which the query arrives.

FIXME; manual proxy ARP (see also Section 9.3, “Breaking a network in two with proxy ARP”), kernel proxy ARP, and the newly supported sysctl net/ipv4/conf/$DEV/medium_id.

For a brief description of the use of medium_id, see Julian's remarks.

FIXME; Kernel proxy ARP with the sysctl net/ipv4/conf/$DEV/proxy_arp.

Note....until this section is written, this post by Don Cohen is rather instructive.