From owner-freebsd-net@FreeBSD.ORG Thu Nov 10 14:08:36 2005 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B337E16A41F for ; Thu, 10 Nov 2005 14:08:36 +0000 (GMT) (envelope-from jon.otterholm@ide.resurscentrum.se) Received: from mail1.cil.se (mail1.cil.se [217.197.56.125]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1C04143D46 for ; Thu, 10 Nov 2005 14:08:35 +0000 (GMT) (envelope-from jon.otterholm@ide.resurscentrum.se) Received: from 192.168.2.10 ([192.168.2.10]) by edusrv05.edu.irc.local ([192.168.44.14]) with Microsoft Exchange Server HTTP-DAV ; Thu, 10 Nov 2005 14:08:34 +0000 Received: from by mail1.cil.se; 10 Nov 2005 15:08:34 +0100 From: Jon Otterholm To: Brian Candler In-Reply-To: <20051110133907.GA67265@uk.tiscali.com> References: <1131541588.996.13.camel@localhost.localdomain> <20051110124903.GB67086@uk.tiscali.com> <1131629107.878.22.camel@localhost.localdomain> <20051110133907.GA67265@uk.tiscali.com> Content-Type: text/plain Content-Transfer-Encoding: 7bit Date: Thu, 10 Nov 2005 15:08:34 +0100 Message-Id: <1131631714.878.34.camel@localhost.localdomain> Mime-Version: 1.0 X-Mailer: Evolution 2.2.3 FreeBSD GNOME Team Port Cc: freebsd-net@freebsd.org Subject: Re: arp-proxy X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Nov 2005 14:08:36 -0000 The point in all this is to reduce administration on my hand and in some cases to offer a service to customers with the feeling that they reside "on the same layer". Today I'm routing the traffic. Alcatels soloution to this is to put an ARP-proxy in a Cisco-router. I cannot understand why Alcatel has put this limitaion in their DSLAM's. Their answer is that it prevents spoofing. I would accept this as a feature but not as a limitation... /J On Thu, 2005-11-10 at 13:39 +0000, Brian Candler wrote: > On Thu, Nov 10, 2005 at 02:25:07PM +0100, Jon Otterholm wrote: > > In all this - our role is similar to an ISP, but we are buying access to > > our customers from an external part. Every customer is delivered on a > > separate vlan trunked. > > > > - Our DSL customers cannot be set on the same VLAN i a single DSLAM > > (don't ask me why - ask Alcatel). > > - We cannot build a simple bridge because the Network service provider > > can't handle when a MAC-address shows up on 2 different VLAN's. > > > > The arp-proxy should do the following: > > - Forward any broadcast packets but rewrite src to its own mac. > > - Forward unicast packets according to FDB but rewrite src to its own > > mac. > > Can you not perform normal routing - that is, allocate a separate IP subnet > to each VLAN? This uses some more IPs than a 'flat' addressing space, but > it's guaranteed to work properly. > > If your DSL traffic is presented as PPPoE, maybe you can get away with just > having a separate PPPoE listener on each VLAN. If it's presented as L2TP you > could use private IPs for the tunnel endpoints. > > Otherwise, a bridge which rewrites source MAC addresses as packets pass > through - that's just too awful to contemplate. As you say, you'd also have > modify ARP responses to have the bogus MAC addresses too. Dealing with > multicast, IGMP, Netbios... no I really don't want to contemplate it :-) > > Regards, > > Brian.