From owner-freebsd-net@FreeBSD.ORG Thu Nov 10 13:39:13 2005 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6F8A816A424 for ; Thu, 10 Nov 2005 13:39:13 +0000 (GMT) (envelope-from b.candler@pobox.com) Received: from thorn.pobox.com (thorn.pobox.com [208.210.124.75]) by mx1.FreeBSD.org (Postfix) with ESMTP id EA39643D6E for ; Thu, 10 Nov 2005 13:39:10 +0000 (GMT) (envelope-from b.candler@pobox.com) Received: from thorn (localhost [127.0.0.1]) by thorn.pobox.com (Postfix) with ESMTP id 6A657BC; Thu, 10 Nov 2005 08:34:36 -0500 (EST) Received: from mappit.local.linnet.org (212-74-113-67.static.dsl.as9105.com [212.74.113.67]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by thorn.sasl.smtp.pobox.com (Postfix) with ESMTP id 2E020679; Thu, 10 Nov 2005 08:34:35 -0500 (EST) Received: from brian by mappit.local.linnet.org with local (Exim 4.54 (FreeBSD)) id 1EaCdv-000HVR-FW; Thu, 10 Nov 2005 13:39:07 +0000 Date: Thu, 10 Nov 2005 13:39:07 +0000 From: Brian Candler To: Jon Otterholm Message-ID: <20051110133907.GA67265@uk.tiscali.com> References: <1131541588.996.13.camel@localhost.localdomain> <20051110124903.GB67086@uk.tiscali.com> <1131629107.878.22.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1131629107.878.22.camel@localhost.localdomain> User-Agent: Mutt/1.4.2.1i Cc: freebsd-net@freebsd.org Subject: Re: arp-proxy X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Nov 2005 13:39:13 -0000 On Thu, Nov 10, 2005 at 02:25:07PM +0100, Jon Otterholm wrote: > In all this - our role is similar to an ISP, but we are buying access to > our customers from an external part. Every customer is delivered on a > separate vlan trunked. > > - Our DSL customers cannot be set on the same VLAN i a single DSLAM > (don't ask me why - ask Alcatel). > - We cannot build a simple bridge because the Network service provider > can't handle when a MAC-address shows up on 2 different VLAN's. > > The arp-proxy should do the following: > - Forward any broadcast packets but rewrite src to its own mac. > - Forward unicast packets according to FDB but rewrite src to its own > mac. Can you not perform normal routing - that is, allocate a separate IP subnet to each VLAN? This uses some more IPs than a 'flat' addressing space, but it's guaranteed to work properly. If your DSL traffic is presented as PPPoE, maybe you can get away with just having a separate PPPoE listener on each VLAN. If it's presented as L2TP you could use private IPs for the tunnel endpoints. Otherwise, a bridge which rewrites source MAC addresses as packets pass through - that's just too awful to contemplate. As you say, you'd also have modify ARP responses to have the bogus MAC addresses too. Dealing with multicast, IGMP, Netbios... no I really don't want to contemplate it :-) Regards, Brian.