On 3/28/2014 12:58 PM, Rich Wales wrote: > Just to see what would happen, I tried adding a network range to the > "proxyarp" file: > > 10.0.229.224/27 tap0 grn0 no > > > in order to handle traffic to an entire subnet living behind a > VPN-connected host in a single configuration directive. > > "shorewall check" didn't complain, but "shorewall restart" did: > > Error: an inet prefix is expected rather than "10.0.229.224/27/32". > ERROR: Command "ip -4 route replace 10.0.229.224/27/32 dev tap0" > Failed > > > Please understand, I didn't really expect this to work, I just wanted to > see what the result would be. > > Clearly (and as I expected), the Shorewall code handling "proxyarp" > entries is currently designed to handle only single addresses. However, > I would think the change to accommodate network ranges shouldn't be too > difficult -- possibly involving the code around lines 84 and 96 in the > setup_one_proxy_arp() function in Proxyarp.pm. Could such a change > perhaps be made in a future release? Or am I overlooking some reason > why this simply won't work or is a really, really bad idea? > > Again, I'm running Shorewall 4.5.16.1 on an Ubuntu 13.10 system.
Rich, The problem you ran into above just involves adding the route to the proxy arp'ed host. Proxy ARP involves adding a 'neighbor' object for each host. And a neighbor is a host, not a network. So Shorewall would have to decompose the network into its individual hosts and run 'ip neigh add ...' for each host. In my view, that is too ugly to consider; not from the programming effort involved, but because it could create a massive number of commands to be executed. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
