I’d like to propose an improvement to the default configuration of the net.ipv4.conf.all.arp_announce setting.
Current Scenario
The default value of 0 for arp_announce implies that ARP requests are sent with the first primary IP address assigned to the outgoing interface, regardless of whether this address is the best source address to reach the target IP. The rationale for keeping it as 0 is understandable — the IP address is considered to belong to the system rather than the interface.
In my current setup, I have two IPs configured on the same wan interface:
x.y.z.207/31
a.b.c.169/29
When sending an ARP request, the system is using the wrong source IP, which in my case is a.b.c.169. This causes incorrect ARP traffic as shown below:
The ISP router at x.y.z.206 doesn't respond to ARP request from an IP outside of his known network (x.y.z.206/31), it has net.ipv4.conf.all.arp_ignore set to 1 (as even OpenWrt does, see /etc/sysctl.d/10-default.conf).
The correct behavior would be to use an IP from the appropriate subnet (x.y.z.207), but due to the default arp_announce=0 setting, the system sends ARP requests using a.b.c.169 instead.
I've modified /etc/sysctl.conf to solve the problem:
can this not be achieved via a simple uci_defaults script ? Generally, in these cases, the needs of many, out weigh the needs of one. When you're the one, you need to handle these issues yourself, usually by building from the sdk, the image builder, or a full build system.
@filippocarletti - The Linux network stack is extremely versatile (some would argue it's even too versatile) to meet all sorts of requirements. That's why there is /etc/sysctl.conf, where you can adjust your system's defaults or configure options for a single interface.
As I said, I have changed the arp_announce settings for my system.
I'm trying to understand if a new default setting could benefit the OpenWrt community.
Nothing prevents you from making a PR on subject. There is no damage in common use cases, and probably yours covers 2/3 of remaining corners.
Maybe the process will become a bit lengthier that some realistic seetup needs checkbox to undo hardening.
OpenWrt has the ability to configure another "interface" @wan, or on the same PHY/interface...or if this subnet is routed to you - there's other options. This is in addition to listing it together. This would probably be the best use case to configure the other network/subnet.
I would try the documented options first.
Make an entirely new interface on your router and address it as:
