How to turn off dynamic ARP on LAN? and use static ARP table

Metu69salemi · Dec 6, 2011, 6:00 PM

What if there could be used arp -f option

lokapal · Dec 7, 2011, 3:56 AM

What if there could be used arp -f option

Surely I use -f, 'cause my table has almost full /24 size - near 230 IP addresses and MACs. It doesn't matter - even from manual of original FreeBSD I cannot understand how to force arp resolution to the definite adapter. Frankly speaking, it is the very stupid situation - the current mode does working only at the desktops with ONE network card, whereas servers frequently have 2-5 interfaces, and servers really do need in static ARP…

lokapal · Dec 7, 2011, 11:43 AM

Well, I checked out, it's the major flaw of FreeBSD :'(
Any Linux system has the much more configurable arp command - each operation has interface suboption. It's marvelous that FBSD grown up to 8.2 and still doesn't have it :-( Probably, pfsense could/should take this program from linux sources….

jimp · Dec 12, 2011, 3:04 PM

Why are you trying to do this manually? Static ARP is set on the DHCP server settings, and it can be controlled per-interface.

Whether or not an interface does static or dynamic arp is controlled with the ifconfig command, not the arp command. The arp command sets static arp entries for IP:MAC, and it figures out which interface that applies to on its own based on the routing table and interface config.

ifconfig rl0 staticarp

Will force only static ARP on rl0

ifconfig rl0 -staticarp

Will switch back to dynamic ARP on rl0.

dhatz · Dec 12, 2011, 3:47 PM

What is the recommended way to protect a pfSense / FreeBSD box from classic ARP poisoning attacks?

There doesn't seem to be a tool like Linux' arptables http://linux.die.net/man/8/arptables
It doesn't seem possible to disable gratuitous ARP.

Is staticarp the only way ?

jimp · Dec 12, 2011, 3:50 PM

There isn't really a standard way - that sort of thing should be handled on your switches.

There are some other tools that have come out that sound promising, but no packages have been made that I'm aware of.

This one looks to be the best bet:
http://arpon.sourceforge.net/

dhatz · Dec 12, 2011, 4:11 PM

Thx jimp, I know about ArpOn and even suggested to add it to pfSense, in the thread packages-wishlist some weeks ago.

Another one I've found is http://acm.poly.edu/wiki/ARP_Counterattack

jimp · Dec 12, 2011, 4:37 PM

That one hasn't had a release in over a year, but that may or may not mean anything significant there.

It probably wouldn't be too hard to add packages for either of those, if someone with the right knowledge had a bit of time to do it.

dhatz · Dec 12, 2011, 4:49 PM

The author, Boris Kochergin, seems pretty active. Doing some googling one finds that he e.g. presented the tool at a NYC BSD group a couple of months ago http://www.nycbug.org/index.php?NAV=Home;SUBM=10310

jimp · Dec 12, 2011, 4:54 PM

Yeah I try not to judge only on release time, especially given how long pfSense has historically gone between releases :-)

You might try adding a bounty to see if there is any interest in someone putting together a package there.