diff --git a/PPPOE_misc_tricks.md b/PPPOE_misc_tricks.md index 8bc4a2e..99fca1e 100644 --- a/PPPOE_misc_tricks.md +++ b/PPPOE_misc_tricks.md @@ -101,3 +101,29 @@ What does it mean and how it works? * awk '{print $1}' - will print first field of each line, which is username, it will remove leading space * xargs -I {} - will pass each line to next command, {} is placeholder for line(variable) * accel-cmd terminate username {} - will disconnect user by username + +## Real IPs routing to multiple PPPoE servers + +In situation when you have more than one PPPoE server and you want to route real IPs to them you can use proxy ARP trick. +How it works? + +1. You route real IPs to your NAT or separate server (anything that can do direct route to interface), for example real subnet a.b.c.0/24 +2. On nat server you have interface facing PPPoE servers, for example bond0.1234, with ip 10.100.100.1/24. where pppoe servers are 10.100.100.10/24, 10.100.100.11/24 10.100.100.12/24. You add route: +``` +ip route add a.b.c.0/24 dev bond0.1234 +``` +3. On pppoe servers you have interfaces facing pppoe server, for example eth4.999 10.100.100.10/24 on first one. You need to execute following commands: +``` +sysctl -w net.ipv4.conf.eth4/999.proxy_arp=1 + +or if interface eth0: +sysctl -w net.ipv4.conf.eth0.proxy_arp=1 +``` + +How this does work? +- When packet comes to your router, it is routed to NAT (or separate server) because of route. +- NAT server sees that packet is for a.b.c.0/24 and sends ARP request "WHERE IS a.b.c.1?" to bond0.1234 because it has route to a.b.c.0/24 over bond0.1234 directly. +- Each PPPoE server due proxy_arp entry will check, do i have a.b.c.1? If yes, it will respond with its own MAC address. +- NAT server will send packet to PPPoE server with a.b.c.1 and PPPoE server will process it. + +This way you can route real IPs to multiple PPPoE servers without need of BGP or other routing protocols. It is simple and works well, but have one caveat, if old entry exist and user changed pppoe, it might need timeout (max 5min) so ARP entry expires.