Subject: Re: ProxyARP and IPSec

From: Thomas Graf <[email-masked]>
Date: Thu, 24 Aug 2006 12:50:37 +0200

* David Miller <[email-masked]> 2006-08-23 15:14
> From: Thomas Graf <[email-masked]>
> Date: Wed, 23 Aug 2006 21:14:25 +0200
> 
> > * H. Peter Anvin <[email-masked]> 2006-08-22 17:31
> > > Specifically, Linux will not ProxyARP for an address unless it has a 
> > > route for it, *and* that route either has a DNAT marking or points to a 
> > > different interface than the input interface:
> > 
> > I can think of a very ugly way: Use netfilter to match on the
> > arp packet prerouting, set nfmark to some value, create a routing
> > rule matching the fwmark again, have it look up a separate table
> > with a dummy route pointing to a dummy device. Make sure to have
> > a proxy neighbour entry as using the device proxy_arp sysctl would
> > fail again.
> 
> This shows we have a usability problem if that's the only way
> to do this :-)

What about adding blackhole device to be used for such routes.
I believe it would be good architecture to always use devices
to state directions packets are being received from and sent to.