We have an x86 box running RouterOS as a ethernet to ethernet hotspot. The inside interface isn’t setup to proxy arp (as per configs shown later) but the box is responding to ARP requests on IPs that it shouldn’t know about.
Network behind the box contains a mixture of private IPs (for managing gear) and public IPs for end users that will go through the hotspot. The private IPs aren’t bound anywhere on the x86 box but RouterOS is proxy arping for them. Here is a sample of the configuration:
/interface ethernet
set 2 arp=enabled auto-negotiation=yes cable-settings=default comment=“” disable-running-check=yes disabled=no full-duplex=yes mac-address=00:15:17:EF:C5:42 mtu=1500 name=inside speed=100Mbps
/ip address
add address=1.1.1.1/24 broadcast=1.1.1.255 comment=“” disabled=no interface=inside network=1.1.1.0
/ip hotspot profile
set default dns-name=“” hotspot-address=0.0.0.0 html-directory=hotspot http-cookie-lifetime=3d http-proxy=0.0.0.0:0 login-by=cookie,http-chap name=default rate-limit=“” smtp-server=0.0.0.0 split-user-domain=no use-radius=no
add dns-name=hotspot.example.com hotspot-address=1.1.1.1 html-directory=hotspot http-proxy=0.0.0.0:0 login-by=http-chap name=hsprof1 nas-port-type=wireless-802.11 radius-accounting=yes radius-default-domain=example.com radius-interim-update=received
radius-location-id=“” radius-location-name=“” radius-mac-format=XX:XX:XX:XX:XX:XX rate-limit=“” smtp-server=0.0.0.0 split-user-domain=no use-radius=yes
/ip hotspot
add address-pool=Wireless addresses-per-mac=2 disabled=no idle-timeout=5d interface=inside keepalive-timeout=20m name=hotspot1 profile=hsprof1
/ip hotspot user profile
set default keepalive-timeout=2d name=default shared-users=1 status-autorefresh=1m transparent-proxy=no
The only addresses that the box should concern itself with are the 1.1.1.0/24 network. However if you ping an IP in the 10.255.0.0/16 network which is also flowing on the same vlan as 1.1.1.0/24 RouterOS responds to the ARP request with its own MAC for that IP.
Any suggestions?