Subject: Re: recommended way to support duplicate IP addresses on different VLANs?

From: Ben Greear <[email-masked]>
Date: Mon, 11 Jul 2011 08:56:06 -0700

On 07/11/2011 08:48 AM, Chris Friesen wrote:
> On 07/11/2011 09:04 AM, Rémi Denis-Courmont wrote:
>> Le lundi 11 juillet 2011 17:58:14 Chris Friesen, vous avez écrit :
>>> Hi all,
>>>
>>> We've got a server that sits on multiple VLANs. Each VLAN is segregated
>>> and doesn't know about the others. The IP address ranges in each of the
>>> VLANs may overlap, and the server may be assigned the same IP address in
>>> multiple VLANs.
>
>>> Is there any other way to deal with this scenario?
>
>
>> Or then binding sockets to devices (SO_BINDTODEVICE) might work.
>
> Hmm...SO_BINDTODEVICE looks interesting. I would imagine we'd still need
> to do some funky stuff around ARP handling.

arp_filter should help.

Also, you may want to use conn-trck tables.  This lets packets coming
in one or more interfaces use a specific conn-track cache.  Might help
keep the identical IPs from colliding in their conn tracking.

iptables -t raw -A PREROUTING -i eth0.7 -j CT --zone 7

Thanks,
Ben

> Chris

-- 
Ben Greear <[email-masked]>
Candela Technologies Inc  http://www.candelatech.com