1 [[!meta title="proxy ARP as an alternative to bridging"]]
3 ## Example: proxy ARP as an alternative to bridging
5 If one wants to have a remote node appear to be on a local LAN (i.e., having an
6 IP address inside the local LAN's subnet), one can set up a bridge at the local
7 node, as described in the [[bridging example|examples/bridging]]. However,
8 setting up a bridge is rather complex, and if one only needs unicast IP traffic
9 to work, and broadcast or non-IP traffic is not a requirement, one can use the
10 [proxy ARP](http://en.wikipedia.org/wiki/Proxy_ARP) features of the operating
13 Since we only use unicast IP traffic, proxy ARP works with both router and
18 The network setup is as follows:
20 * Office LAN, the LAN on interface eth0 uses the range 192.168.1.0/24. The office node uses the address 192.168.1.2.
21 * Road warrior, using the address 192.168.1.123.
23 ### Configuration of tinc at the office
25 > host# cat /etc/tinc/vpn/tinc.conf
30 > host# cat /etc/tinc/vpn/tinc-up
33 > ifconfig $INTERFACE 192.168.1.2 netmask 255.255.255.255
34 > route add 192.168.1.123 dev $INTERFACE
35 > echo 1 >/proc/sys/net/ipv4/conf/eth0/proxy_arp
36 > echo 1 >/proc/sys/net/ipv4/conf/$INTERFACE/proxy_arp
38 > host# ls /etc/tinc/vpn/hosts
39 > office roadwarrior ...
41 > host# cat /etc/tinc/vpn/hosts/office
42 > Address = 123.234.123.42
43 > Subnet = 192.168.1.0/24
44 > -----BEGIN RSA PUBLIC KEY-----
46 > -----END RSA PUBLIC KEY-----
48 > host# cat /etc/tinc/vpn/hosts/roadwarrior
49 > Subnet = 192.168.1.123
50 > -----BEGIN RSA PUBLIC KEY-----
52 > -----END RSA PUBLIC KEY-----
54 ### Configuration of tinc at the road warrior
56 > host# cat /etc/tinc/vpn/tinc.conf
61 > host# cat /etc/tinc/vpn/tinc-up
64 > ifconfig $INTERFACE 192.168.1.123 netmask 255.255.255.0
66 The host config files are, of course, identical to those on the office node.
68 ### Automatically adding routes
70 In the above configuration, the `tinc-up` script of the office node has a route
71 to the roadwarrior's address hardcoded. To have tinc automatically add the
72 necessary routes, remove the `route add` command from the `tinc-up` script, and
73 instead add this `subnet-up` script:
75 > host# cat /etc/tinc/vpn/subnet-up
77 > [ "$NAME" = "$NODE" ] && exit 0
78 > ip route replace $SUBNET dev $INTERFACE