On 08/11/2017 02:57 AM, Philip Le Riche wrote: > Does the mere existence of a DNAT rule cause the system to respond to > ARP requests for the translated IP address? > > When I originally set up the system I assumed I had to add additional IP > addresses to the external interface for each of my DNAT rules, but > reading random docs I suddenly thought maybe I needn't have - I can't > now see anything that tells me I had to. A quick experiment on my home > system was inconclusive - probably a bug in my rules. > > (I've long suspected that the 16 extra IP addresses on my external NIC > is what is causing slow network initialisation and hence failure of sshd > and apache to bind to their ports on boot.) >
DNAT does not automatically cause ARP responses for external IP address. Shorewall provides the ADD_IP_ALIASES option in shorewall.conf which will automatically add these addresses to the external interface. -Tom -- Tom Eastep \ Q: What do you get when you cross a mobster with Shoreline, \ an international standard? Washington, USA \ A: Someone who makes you an offer you can't http://shorewall.org \ understand \_______________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
