How to change the host model of TCP/IP stack from weak model to strong model?
Also related is the end of another page on this site: Multi-homed hosts and ARP.
Objective
The reason to set the strong host model is to avoid some security problems. My understanding is that it is easy to set firewall rules to achieve the same level of security and is a little easier to do so maybe that would be a better option for your setup.
Background
To demonstrate the setup the system has two network interfaces, they are named
eth0 and eth1 (of course they will probably be different on a system using
predictable interface naming, enp5s0 or something).
- Each interface will be given its own routing table
eth0the interface will be configured with DHCPeth1will be configured with a static IP address
This configuration can be error-prone and so careful verification and monitoring is necessary.
Configuration with systemd-networkd
For eth0, dhcp enabled:
# /usr/lib/systemd/network/20-wired-network-eth0.network
[Match]
Name=eth0
[Network]
DHCP=yes
[DHCPv4]
RouteTable=100
[DHCP]
UseMTU=yes
RouteMetric=10
ClientIdentifier=mac
For eth1:
# /usr/lib/systemd/network/20-wired-network-eth1.network
[Match]
Name=eth1
[Network]
DHCP=no
[Address]
Address=10.8.0.1/16
AddPrefixRoute=false
[Route]
Destination=10.8.0.0/16
Scope=link
Table=8
[RoutingPolicyRule]
From=10.8.0.0/16
To=10.8.0.0/16
IncomingInterface=eth1
Table=8
[RoutingPolicyRule]
From=10.8.0.0/16
To=10.8.0.0/16
Table=8
The [Route] line adds the same entry that AddPrefixRoute would have added
to the main routing table. The default when using iproute2 is to add the
scoped route to the main routing table, to prevent this behaviour the command
may be postfixed with noprefixroute.
The [RoutingPolicyRule] will add the required entries to the ip rules:
# ip rule show
0: from all lookup local
32764: from 10.8.0.0/16 to 10.8.0.0/16 lookup 99
32765: from 10.8.0.0/16 to 10.8.0.0/16 iif eth1 lookup 8
32766: from all lookup main
32767: from all lookup default
Notice that there are no rules to allow the DHCP configured interface to use table 100, even though table 100 has been updated with the required entries.
# ip route show table 100
default via 192.168.1.1 dev eth0 src 192.168.1.123 metric 10
192.168.1.0/24 dev eth0 scope link src 192.168.1.123 metric 10
192.168.1.1 dev eth0 scope link src 192.168.1.123 metric 10
At this time I am not sure how to fix that except by adding [RoutingPolicyRule]
entries for eth0 with the subnet of the DHCP server... obviously not a
great idea.
Performing this Manually with iproute2
TODO: write some iproute2 commands to do the same as systemd-networkd
ARP Replies
This will prevent the system from answering ARP requests received on an interface where the requested address does not match the address assigned to that interface.
net.ipv4.conf.all.arp_filter=1
net.ipv4.conf.all.arp_ignore=1 # or even 2
net.ipv4.conf.all.arp_announce=2