Linux – Arch Linux – Add Multiple IP Addresses to Network

Your chosen solution works, but there are alternatives that don't involve arptables. (Christopher Cashell was on the right track, originally, but he was off by a smidge.)

In short, you want to set these parameters:

net.ipv4.conf.all.arp_ignore=1
net.ipv4.conf.all.arp_announce=2

These should be available when running a modern, 2.6 series Linux kernel. Check and make sure you that '/proc/sys/net/ipv4/conf//arp_announce' and /proc/sys/net/ipv4/conf//arp_ignore' exist on your system.

The 'arp_filter' parameter only works when your various IP addresses share a LAN segment but use different IP subnet. If they share the IP subnet, too, you need to use 'arp_ignore' and 'arp_announce', as above.

(I believe you may also need to set 'arp_filter' back to '0', too.)

Since the IPs both come from the same ISP, you can just apply the addresses from the new block to the MIPs on the existing untrust interface. You don't have to define a second physical interface.

This works because the Netscreen is also a router.

So, when the world wants to send packets to the new block, the ISP will ARP for the IP on the new block, and your Netscreen will respond.

When the Netscreen needs to send packets back to the rest of the world from an IP on the new block, it will use the default router from the existing block; the ISP should accept this traffic.

This isn't intuitive, but it works.