2

We have this situation: A router, which is an Ubuntu VM, has multiple VLAN interfaces on the same physical NIC. Those VLAN interfaces are dynamically configured and torn down and attached to networks where machines can be added or removed by users.

Sometimes we have a situation where, for example, on VLAN 1 the router has the IP 10.0.0.254 and a neighbor machine has the IP 10.0.0.1. While, at the same time, on VLAN 2 the router has the IP 10.0.0.1 and a neighbor machine has the IP 10.0.0.2.

When, on VLAN 1 10.0.0.1 is sending an ARP asking "who has 10.0.0.254 tell 10.0.0.1" the router does not respond. Sniffing traffic on the router shows that the ARP requests arrive with proper VLAN tagging but are discarded.

Does the router discard the ARP message thinking that it arrived in the wrong interface?

A few notes:

  1. On VLAN 2 there are no ARP problems.
  2. Replacing the IP of the neighbor VM on VLAN 1 (10.0.0.1) to 10.0.0.3 solves the problem.
  3. As I mentioned, both IP's (10.0.0.254 and 10.0.0.1) are on the same MAC address.
  4. arp_filter is set to 0 on all interfaces
  5. the router's routing table does not refer all those dynamic interfaces. we use iptables and fwmarks along with IP rules and custom routing tables (all are dynamically set by software) to route traffic separately according to the VLAN it is originated.

Where is the problem?

4
  • Why you have not on every VLAN one subnet of 10.0.0.0 network, for example: VLAN1: 10.0.1.0/24, VLAN2: 10.0.2.0/24?
    – Jan Marek
    Apr 23, 2013 at 13:28
  • this is because the networks and hosts settings are dynamic. Networks and hosts may appear and disappear as users create them. And anyways, isn't that what VLANs are all about? Separating the same network to several logical networks?
    – Ido
    Apr 24, 2013 at 4:54
  • No. VLANs are for dividing the same network to the separated segments to protect some sources againts some users - for example servers for financial reports against technology users and vice versa. But you have to have network well segmented - it's a good advice, trust me. You will not have this type of questions... And you can have dynamically added and removed host on the every segment you want - use dhcp server.
    – Jan Marek
    Apr 24, 2013 at 8:54
  • Those are not options for us. The fact that we do not control IP's and that IP's are set statically is a given. All I have for isolating the networks is VLAN tagging and the actual VLAN that the machines get connected to (this we do control programmatically).
    – Ido
    Apr 24, 2013 at 10:39

3 Answers 3

2

Having a single network node connect to two different networks that use the same IP addresses is not a supported configuration. Address conflicts is a well known shortcoming of using RFC 1918 addresses. This is the reason why RFC 4193 was introduced and specifies that 40 of the address bits must be randomly generated.

If you don't want to renumber the networks to solve the address conflict, and if you don't want to upgrade to IPv6, which avoids such conflicts happening in the first case, then the most reliable setup you can get is from splitting that single network node into two or more network nodes.

A single Linux VM can operate as multiple independent network nodes simultaneously. That feature is called network namespaces. Each network namespace has its own set of network interfaces, local addresses, routing table entries, and firewall rules. The different network namespaces can communicate with each other through virtual network interfaces.

Documentation on the network namespaces feature can be found using man ip-netns (or man ip if you are using an older version.)

0

If the router has the IP address 10.0.0.1 on one of its interfaces, then another machine claiming to have that IP address is considered to be ARP spoofing. Even if you did get it to answer ARP, you'd never be able to send packets from the router to 10.0.0.1 - what would the routing table look like?

You need to give the router and everything it's connected to distinct IP addresses.

1
  • the router's routing does not refer all those dynamic interfaces. we use iptables and fwmarks along with IP rules and custom routing tables to route traffic separately according to the VLAN it is originated from (updating the question with this info).
    – Ido
    Apr 24, 2013 at 4:59
0

It sounds like your user's machines are not configured to send out gratuitous ARP requests when they are initially created or when an IP is newly assigned to them. You can accomplish such thing using the arping utility.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .