Comment 9 for bug 1664748

Revision history for this message
Mike Pontillo (mpontillo) wrote :

One last note on this. It might be possible to get this setup to work (on the client) using the following sysctl changes:

net.ipv4.conf.all.arp_filter = 1 (or 0)
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.all.arp_ignore = 2

This is completely untested. But in theory[1]:

 - arp_filter = 1: "allows you to have multiple network interfaces on the same subnet", according to the kernel docs. However, the decision is "based on whether or not the kernel would route a packet from the ARP'd IP out that interface". So that might need to remain set to zero. So worst case, it still wouldn't work, or the DHCP server would get conflicting ARP replies (possibly making the problem worse for the wired interface).

 - rp_filter = 2: the default in Ubuntu is for strict reverse-path filtering, which might cause us to fail to receive unicast DHCP ACK replies, if we see packets coming to a wireless interface [with a lower metric] which we don't expect. Loose reverse-path filtering should allow this, though it would roll back significant security properties that rp_filter=1 adds.

 - arp_ignore = 2: an attempt to mitigate the fact that ARP filtering might allow more than interface to reply to the ARP by ensuring that only interfaces configured with the address can reply. (Use this if arp_filter=1 isn't doing the trick and you need to try arp_filter=0.)

[1]: based on https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt