1 [[!meta title="proxy ARP as an alternative to bridging"]]
3 ## Example: proxy ARP as an alternative to bridging
5 If one wants to have a remote node appear to be on a local LAN (i.e., having an
6 IP address inside the local LAN's subnet), one can set up a bridge at the local
7 node, as described in the [[bridging example|examples/bridging]]. However,
8 setting up a bridge is rather complex, and if one only needs unicast IP traffic
9 to work, and broadcast or non-IP traffic is not a requirement, one can use the
10 [proxy ARP](https://en.wikipedia.org/wiki/Proxy_ARP) features of the operating
13 Since we only use unicast IP traffic, proxy ARP works with both router and
18 The network setup is as follows:
20 * Office LAN, the LAN on interface eth0 uses the range 192.168.1.0/24. The office node uses the address 192.168.1.2.
21 * Road warrior, using the address 192.168.1.123.
23 ### Configuration of tinc at the office
25 host# cat /etc/tinc/vpn/tinc.conf
30 host# cat /etc/tinc/vpn/tinc-up
33 ifconfig $INTERFACE 192.168.1.2 netmask 255.255.255.255
34 route add 192.168.1.123 dev $INTERFACE
35 echo 1 >/proc/sys/net/ipv4/conf/eth0/proxy_arp
36 echo 1 >/proc/sys/net/ipv4/conf/$INTERFACE/proxy_arp
38 host# ls /etc/tinc/vpn/hosts
39 office roadwarrior ...
41 host# cat /etc/tinc/vpn/hosts/office
42 Address = 123.234.123.42
43 Subnet = 192.168.1.0/24
44 -----BEGIN RSA PUBLIC KEY-----
46 -----END RSA PUBLIC KEY-----
48 host# cat /etc/tinc/vpn/hosts/roadwarrior
49 Subnet = 192.168.1.123
50 -----BEGIN RSA PUBLIC KEY-----
52 -----END RSA PUBLIC KEY-----
54 ### Configuration of tinc at the road warrior
56 host# cat /etc/tinc/vpn/tinc.conf
62 host# cat /etc/tinc/vpn/tinc-up
65 ifconfig $INTERFACE 192.168.1.123 netmask 255.255.255.0
67 The host config files are, of course, identical to those on the office node.
69 ### Automatically adding routes
71 In the above configuration, the `tinc-up` script of the office node has a route
72 to the roadwarrior's address hardcoded. To have tinc automatically add the
73 necessary routes, remove the `route add` command from the `tinc-up` script, and
74 instead add this `subnet-up` script:
76 host# cat /etc/tinc/vpn/subnet-up
78 [ "$NAME" = "$NODE" ] && exit 0
79 ip route replace $SUBNET dev $INTERFACE