On Sat, 4 Apr 2026, Stuart Henderson wrote:
You can configure a private address on the hosts ethernet interfaces, the public address on a loopback (e.g. lo1), and on the gateway route the public address to the private address. ARP will work normally.
This is more of a redirection than an answer. Yes, things could be changed elsewhere, but not without creating other problems; that's why I'm here trying to solve it on the router where I have the most control.
In this case, if the host holds both public and private addresses, it will incorrectly select the private one as default source address for outbound connections.
Am I to understand that an OpenBSD router cannot be made to route packets as it's told? Why not?
The concept of subnet masks doesn't enter into ARP as a protocol, so there's nothing abnormal here from that standpoint; just unexpected implementation restrictions, it seems. Indeed we even see it working temporarily with the -iface -link flags.
Jacob -- Please keep me copied on replies.
