Re: Firewall for isolated hosts

I was able to configure /32 for ipv4.

in the example below, I use vlan10 and a private address for testing.

Each host in separated using PVLAN.

On the openbsd (router) side, I just do

ifconfig vlan10 inet 172.16.216.1/32
route add -inet 172.16.216.0/24 -llinfo -link -static -iface vlan10

On a linux box, I can do:

ip addr add 172.16.216.3 dev eno1 peer 172.16.216.1/32

Now for ipv6

On the linux side:

ip addr add xxxx:xxxx:0:1000:1::1/64 dev eno1
ip route add default via fe80::1 dev eno1

On the OpenBsd side:

ifconfig vlan10 inet6 fe80::1
route add -inet6 xxxx:xxxx:0:1000::/64 fe80::aaaa:bbbb:cccc:dddd%vlan10

where aaaa:bbbb:cccc:dddd is the mac address of the linux host

Now the problem is that I will have to add a route entry for every host and know
their link local address.

I don't think there is any workaround to this. Except adding a second,
pre-defined link local address to the linux host.

Regards

--
Nicolas Goy
Developer and Engineer
Goyman SA