Filter ARP request

[rootnetworks]

Hi guys

how to filter ARP request in proxmox? I also read this port https://forum.proxmox.com/threads/filter-arp.34973/ but no luck


I see there a lot of ARP request between VMs

something like this

8:21:36.874382 ARP, Request who-has 192.168.1.215 tell 192.168.1.1, length 46 08:21:36.874705 ARP, Request who-has 192.168.1.101 tell 192.168.1.1, length 46 08:21:36.875043 ARP, Request who-has 192.168.1218 tell 192.168.11, length 46 08:21:36.875355 ARP, Request who-has 192.168.1174 tell 192.168.11, length 46 08:21:36.875662 ARP, Request who-has 192.168.1.242 tell 192.168.1.1, length 46 08:21:36.875981 ARP, Request who-has 192.168.1.132 tell 192.168.1.1, length 46 08:21:36.876291 ARP, Request who-has 192.168.1.160 tell 192.168.1.1, length 46 08:21:36.876596 ARP, Request who-has 192.168.1.65 tell 192.168.1.1, length 46 08:21:36.876922 ARP, Request who-has 192.168.1.43 tell 192.168.1.1, length 46 08:21:36.882186 ARP, Request who-has 192.168.1.240 tell 192.168.1.1, length 46

My firewall configuration
data center level firewall: yes ebtables: yes Log rate limit: Default input Policy: DROP Output Policy: ACCEPT Server Level firewall: yes SMURFS filter: yes TCP flags filter: no NDP: yes nf_conntrack_max: Default nf_conntrack_tcp_timeout_established: Default log_level_in: nolog log_level_out: nolog tcp_flags_log_level: nolog smurf_log_level: nolog VM Level firewall: yes DHCP: no NDP: yes router advertisement: no MAC filter: yes IP filter: yes log_level_in: nolog log_level_out: nolog input policy: accept output policy: accept

Thanks

 

[Richard]

how to filter ARP request in proxmox?

Depends on what in particular want to filter out and how your topology looks like (respectively: how are the VMs configured in both PVE host and regarding network interfaces inside). In any case it has to be done by ebtables and/or iptables commands at the command line.

 

[rootnetworks]

Depends on what in particular want to filter out and how your topology looks like (respectively: how are the VMs configured in both PVE host and regarding network interfaces inside). In any case it has to be done by ebtables and/or iptables commands at the command line.

@Richard

Do you have documents for this?

My environment all PVE hosts in the same vlan.
VM NIC> vmbr0(bridge) > physical NIC

Thank you

 

[Richard]

The following may give some hints: http://ebtables.netfilter.org/examples/basic.html#all

 

[rootnetworks]

@Richard
I see some arp rules already exist
The problem now is that the VM will receive ARP requests from different subnets. This appears to be unexpected.
The VM inbound firewall should filter ARP requests whose destination is not its own IP

for example -p ARP --arp-ip-dst !192.168.87.124 -j DROP

Bridge chain: tap10761i0-OUT, entries: 3, policy: ACCEPT
-s ! b2:8a:5d:b3:ff:aa -j DROP
-p ARP -j tap10761i0-OUT-ARP
-j ACCEPT

Bridge chain: tap10761i0-OUT-ARP, entries: 2, policy: ACCEPT
-p ARP --arp-ip-src 192.168.87.124 -j RETURN
-j DROP

Bridge chain: tap107i0-OUT, entries: 2, policy: ACCEPT
-s ! e:78:a5:94:2e:21 -j DROP
-j ACCEPT