Linux

There are a few parameters that can (and usually should) be tuned:

• ARP filtering & source routing
• Reverse Path (RP) filter

For more information on tuning your Linux system for routing, see the Linux Advanced Routing & Traffic Control HOWTO. NOTE: Please be aware while configuring sysctl parameters, that interface specific entries override global ones. For instance, proxy-arp will be enabled (which is undesirable) if both of these are set:

• net.ipv4.conf.eth0.proxy_arp = 1
• net.ipv4.conf.all.proxy_arp = 0

The Linux approach to IP addresses is that they belong to the system, not any single interface.In other words, a Linux host will answer to ARP queries coming in on any interface if the queried address is configured on any of its interfaces. The idea behind this is that an IP address belongs to the system, not just to a single interface. Although this may work well for server or desktop systems, it is not desirable behaviour in a router system. One reason is that it is a limited version of proxy-arp, which is forbidden on the VarnaIX peering LAN. Another reason is that two separate routers could potentially answer ARP queries for the same RFC1918 address. The ARP behaviour can be fixed by using arp_ignore and arp_announce:

• sysctl -w net.ipv4.conf._VarnaIX_ifname_.arp_ignore=1
• sysctl -w net.ipv4.conf._VarnaIX_ifname_.arp_announce=1

Proxy ARP

Disable proxy-arp using sysctl:

• sysctl -w net.ipv4.conf._VarnaIX_ifname_.proxy_arp=0

IPV6 Autoconfiguration

IPv6 stateless autoconfiguration must be disabled:

• sysctl -w net.ipv6.conf._VarnaIX_ifname_.autoconf=0

RP Filter Setting

You may need to turn off the Reverse Path Filter (rp_filter) functionality on a Linux-based router to allow asymmetric routing, particularly on your interface.To disable the RP filter:

• sysctl -w net.ipv4.conf._VarnaIX_ifname_.rp_filter=0

Running the 'sysctl' Commands at Boot

The various system parameters discussed above can be set at boot time by adding it to a file such as /etc/sysctl.conf. The exact name, location and very existence of this file typically depends on the Linux distribution in use, but both Debian and Red Hat/Fedora use /etc/sysctl.conf:

• net.ipv4.conf._VarnaIX_ifname_.arp_ignore=1
• net.ipv4.conf._VarnaIX_ifname_.arp_announce=1
• net.ipv4.conf._VarnaIX_ifname_.proxy_arp=0
• net.ipv6.conf._VarnaIX_ifname_.autoconf=0
• net.ipv4.conf._VarnaIX_ifname_.rp_filter=0

ROA+IRR Validation

( Comming soon... )

---