On 02/23/2018 02:18 PM, Vieri Di Paola via Shorewall-users wrote: > > ________________________________ > From: Tom Eastep <teas...@shorewall.net> >>> >>> Can I avoid replying ARP requests for 192.168.200.0/24 only? >>> >> Yes -- add a DROP entry in /etc/shorewall/arprules. > > > Thanks. However, I don't understand why the ARP replies were generated even > if I set "arp_filter=1" for that interface ($IF_LAN in my example). This > interface does not have any IP address configured within 192.168.200.0/24. >
arp_filter controls whether ARP requests for addresses on other interfaces are answered -- but when you enable proxy_arp, ARP requests for any address for which the system has a route (out of any interface) are answered. -Tom -- Tom Eastep \ Q: What do you get when you cross a mobster with Shoreline, \ an international standard? Washington, USA \ A: Someone who makes you an offer you can't http://shorewall.org \ understand \_______________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
