1 [[!meta title="proxy ARP as an alternative to bridging"]]
3 ## Example: proxy ARP as an alternative to bridging
5 If one wants to have a remote node appear to be on a local LAN (i.e., having an
6 IP address inside the local LAN's subnet), one can set up a bridge at the local
7 node, as described in the [[bridging example|examples/bridging]]. However,
8 setting up a bridge is rather complex, and if one only needs unicast IP traffic
9 to work, and broadcast or non-IP traffic is not a requirement, one can use the
10 [proxy ARP](https://en.wikipedia.org/wiki/Proxy_ARP) features of the operating
13 Since we only use unicast IP traffic, proxy ARP works with both router and
18 The network setup is as follows:
20 * Office LAN, the LAN on interface eth0 uses the range 192.168.1.0/24. The office node uses the address 192.168.1.2.
21 * Road warrior, using the address 192.168.1.123.
23 ### Configuration of tinc at the office
25 host# cat /etc/tinc/vpn/tinc.conf
30 host# cat /etc/tinc/vpn/tinc-up
33 ifconfig $INTERFACE 192.168.1.2 netmask 255.255.255.255
34 route add 192.168.1.123 dev $INTERFACE
35 echo 1 >/proc/sys/net/ipv4/conf/eth0/proxy_arp
36 echo 1 >/proc/sys/net/ipv4/conf/$INTERFACE/proxy_arp
38 host# ls /etc/tinc/vpn/hosts
39 office roadwarrior ...
41 host# cat /etc/tinc/vpn/hosts/office
42 Address = 123.234.123.42
43 Subnet = 192.168.1.0/24
44 -----BEGIN RSA PUBLIC KEY-----
46 -----END RSA PUBLIC KEY-----
48 host# cat /etc/tinc/vpn/hosts/roadwarrior
49 Subnet = 192.168.1.123
50 -----BEGIN RSA PUBLIC KEY-----
52 -----END RSA PUBLIC KEY-----
54 ### Configuration of tinc at the road warrior
56 host# cat /etc/tinc/vpn/tinc.conf
61 host# cat /etc/tinc/vpn/tinc-up
64 ifconfig $INTERFACE 192.168.1.123 netmask 255.255.255.0
66 The host config files are, of course, identical to those on the office node.
68 ### Automatically adding routes
70 In the above configuration, the `tinc-up` script of the office node has a route
71 to the roadwarrior's address hardcoded. To have tinc automatically add the
72 necessary routes, remove the `route add` command from the `tinc-up` script, and
73 instead add this `subnet-up` script:
75 host# cat /etc/tinc/vpn/subnet-up
77 [ "$NAME" = "$NODE" ] && exit 0
78 ip route replace $SUBNET dev $INTERFACE