Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have this situation: A router, which is an Ubuntu VM, has multiple VLAN interfaces on the same physical NIC. Those VLAN interfaces are dynamically configured and torn down and attached to networks where machines can be added or removed by users.

Sometimes we have a situation where, for example, on VLAN 1 the router has the IP 10.0.0.254 and a neighbor machine has the IP 10.0.0.1. While, at the same time, on VLAN 2 the router has the IP 10.0.0.1 and a neighbor machine has the IP 10.0.0.2.

When, on VLAN 1 10.0.0.1 is sending an ARP asking "who has 10.0.0.254 tell 10.0.0.1" the router does not respond. Sniffing traffic on the router shows that the ARP requests arrive with proper VLAN tagging but are discarded.

Does the router discard the ARP message thinking that it arrived in the wrong interface?

A few notes:

  1. On VLAN 2 there are no ARP problems.
  2. Replacing the IP of the neighbor VM on VLAN 1 (10.0.0.1) to 10.0.0.3 solves the problem.
  3. As I mentioned, both IP's (10.0.0.254 and 10.0.0.1) are on the same MAC address.
  4. arp_filter is set to 0 on all interfaces
  5. the router's routing table does not refer all those dynamic interfaces. we use iptables and fwmarks along with IP rules and custom routing tables (all are dynamically set by software) to route traffic separately according to the VLAN it is originated.

Where is the problem?

share|improve this question
    
Why you have not on every VLAN one subnet of 10.0.0.0 network, for example: VLAN1: 10.0.1.0/24, VLAN2: 10.0.2.0/24? –  Jan Marek Apr 23 '13 at 13:28
    
this is because the networks and hosts settings are dynamic. Networks and hosts may appear and disappear as users create them. And anyways, isn't that what VLANs are all about? Separating the same network to several logical networks? –  Ido Apr 24 '13 at 4:54
    
No. VLANs are for dividing the same network to the separated segments to protect some sources againts some users - for example servers for financial reports against technology users and vice versa. But you have to have network well segmented - it's a good advice, trust me. You will not have this type of questions... And you can have dynamically added and removed host on the every segment you want - use dhcp server. –  Jan Marek Apr 24 '13 at 8:54
    
Those are not options for us. The fact that we do not control IP's and that IP's are set statically is a given. All I have for isolating the networks is VLAN tagging and the actual VLAN that the machines get connected to (this we do control programmatically). –  Ido Apr 24 '13 at 10:39

1 Answer 1

If the router has the IP address 10.0.0.1 on one of its interfaces, then another machine claiming to have that IP address is considered to be ARP spoofing. Even if you did get it to answer ARP, you'd never be able to send packets from the router to 10.0.0.1 - what would the routing table look like?

You need to give the router and everything it's connected to distinct IP addresses.

share|improve this answer
    
the router's routing does not refer all those dynamic interfaces. we use iptables and fwmarks along with IP rules and custom routing tables to route traffic separately according to the VLAN it is originated from (updating the question with this info). –  Ido Apr 24 '13 at 4:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.