Re: Hiding an IP address on a multi-homed bridging firewall!!

On 7/3/2008 12:19 AM, Ramsurrun Visham wrote:
> I have a machine acting as a stealth firewall with three interfaces. 
> Only interfaces eth0 and eth1 are enslaved to the bridge device br0, 
> and none of them are given IP addresses. eth2 connects to a different 
> network and has an IP address assigned to it. Traffic travels from 
> eth0 to eth1 and vice-versa. I wanted to know how can I make 
> computers found on the eth0 and eth1 sides of the bridge, not see the 
> eth2 IP address. The problem is that I sometimes see ARP requests 
> with the eth2's IP address as src IP address. When I disable the eth2 
> interface, I get ARP requests with src IP address 0.0.0.0, which is 
> fine. But when eth2 is up, I see its IP address. How can I hide it?
> 
> Any help will be much appreciated..

First, I *think* you are /not/ crazy.  In fact, I had to re-read what 
you wrote a couple of times to make sure that there was not a problem 
with what you have in place.

After I was satisfied that the problem was not in your config, because I 
completely agree with it, I then immediately thought back to something I 
read about ARPs and the Linux kernel.  In short, (to quote the kernel 
documentation)  "IP addresses are owned by the complete host on Linux, 
not by particular interfaces.".  So, I think the kernel is allowing ARPs 
to ""leak across interfaces.

Do some reading (search for "arp") in the <kernel source 
directory>/Documentation/networking/ip-sysctl.txt file.

I think you will want to change the following entries to these values.

arp_filter = 1
arp_announce = 1
arp_ignore = 2 or better 3



Grant. . . .

-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08