Default net.ipv4.conf.all.proxy_arp=1 introduces duplicate IP when OpenWrt interface is active for VLAN

[Equin]

Team, recently I had to configure very simple switch using two ports and cpu untagged for vlan_1:

config device
option name 'eth0.1'
option type '8021q'
option ifname 'eth0'
option vid '1'

config switch_vlan
option device 'switch0'
option ports '0 1 6'
option vlan '1'

and discovered strange behavior when an OpenWrt interface created on eth0.1 (to allow OpenWrt management on this vlan) introduced duplicate IPs for all subnet, including the gateway. Figured it out with arping that returned two MAC addresses - the original non-OpenWrt switch MAC and OpenWrt one.

sysctl net.ipv4.conf.all.proxy_arp=0 did the trick, but I'd like to ask if these Luci options for device like Honor gratuitous ARP and Drop gratuitous ARP play any role here? I tried all combos of these two options but only manual sysctl net.ipv4.conf.all.proxy_arp=0 actually works.

Probably I missed something and would welcome any idea if it is manageable via Luci.

Update: finally found that it was mesh11sd daemon (needed for mesh management), see the bottom of this tread for details.

[brada4]

No, gratutious arp is unrelated. proxy_arp fix to not respond own mapping back was submitted upstream, if you can test if snapshot works, then next stable release also will.

[Equin]

I've just tried today's build - the issue is still there. Here is some details:

The interface configured on eth0.1 and interface autostart disabled, rebooted to get default settings with disabled interface:

# sysctl -a | grep ipv4.*proxy_arp
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.conf.all.proxy_arp_pvlan = 1
net.ipv4.conf.br-lan.proxy_arp = 1
net.ipv4.conf.br-lan.proxy_arp_pvlan = 1
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.default.proxy_arp_pvlan = 1
net.ipv4.conf.eth0.proxy_arp = 1
net.ipv4.conf.eth0.proxy_arp_pvlan = 1
net.ipv4.conf.eth0/1.proxy_arp = 0
net.ipv4.conf.eth0/1.proxy_arp_pvlan = 0
net.ipv4.conf.lo.proxy_arp = 0
net.ipv4.conf.lo.proxy_arp_pvlan = 0

Starting the interface on eth0.1 via Luci:

# sysctl -a | grep ipv4.*proxy_arp
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.conf.all.proxy_arp_pvlan = 1
net.ipv4.conf.br-lan.proxy_arp = 1
net.ipv4.conf.br-lan.proxy_arp_pvlan = 1
net.ipv4.conf.default.proxy_arp = 1
net.ipv4.conf.default.proxy_arp_pvlan = 1
net.ipv4.conf.eth0.proxy_arp = 1
net.ipv4.conf.eth0.proxy_arp_pvlan = 1
net.ipv4.conf.eth0/1.proxy_arp = 1
net.ipv4.conf.eth0/1.proxy_arp_pvlan = 1
net.ipv4.conf.lo.proxy_arp = 0
net.ipv4.conf.lo.proxy_arp_pvlan = 0

so, after start it enables proxy_arp for this interface.

But the problem is much deeper - let's disable all proxy_arp for both vlan and parent device:

# sysctl net.ipv4.conf.eth0.proxy_arp=0; sysctl net.ipv4.conf.eth0.proxy_arp_pvlan=0; sysctl net.ipv4.conf.eth0/1.proxy_arp=0; sysctl net.ipv4.conf.eth0/1.proxy_arp_pvlan=0
net.ipv4.conf.eth0.proxy_arp = 0
net.ipv4.conf.eth0.proxy_arp_pvlan = 0
net.ipv4.conf.eth0/1.proxy_arp = 0
net.ipv4.conf.eth0/1.proxy_arp_pvlan = 0

arping of interface IP still shows two MAC addresses.

Only global proxy_arp off helps to get rid of dupes:

sysctl net.ipv4.conf.all.proxy_arp=0

I remember I tried to troubleshoot this strange behavior years ago, trying to manipulate proxy_arp on interface level (no luck) and I suspect there is a kind of bug in the kernel with arp proxy logic...

[brada4]

You can find arptables rule in the thread to block arp reflection, or wait for release with patch included:

Wi-Fi Proxy ARP breaks poorly implemented DHCP clients

Or disable (ie not enable) proxy_arp in the meantime.

[Equin]

Finally found who does the mess! It's mesh11sd package (I have mesh uplink on this node):

# grep proxy_arp /usr/sbin/mesh11sd
	echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp
	echo 1 > /proc/sys/net/ipv4/conf/default/proxy_arp
	echo 1 > /proc/sys/net/ipv4/conf/$device/proxy_arp
	echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp_pvlan
	echo 1 > /proc/sys/net/ipv4/conf/default/proxy_arp_pvlan
	echo 1 > /proc/sys/net/ipv4/conf/$device/proxy_arp_pvlan

By default all proxy_arp are off in the system after boot - how it should be. No issues with OpenWrt at all but with the mesh11sd package, that enables it "just in case".

To resolve it I just changed "1" to "0" in /usr/sbin/mesh11sd, so now it looks:

	echo 0 > /proc/sys/net/ipv4/conf/all/proxy_arp
	echo 0 > /proc/sys/net/ipv4/conf/default/proxy_arp
	echo 0 > /proc/sys/net/ipv4/conf/$device/proxy_arp
	echo 0 > /proc/sys/net/ipv4/conf/all/proxy_arp_pvlan
	echo 0 > /proc/sys/net/ipv4/conf/default/proxy_arp_pvlan
	echo 0 > /proc/sys/net/ipv4/conf/$device/proxy_arp_pvlan