Proxy arp is a way to build a pseudo bridge that is working on OSI layer 3 but it behaves like a real layer 2 bridge. So it is a good way to workaround the lack of WDS support on Raspberry Pi. Here There are mainly two methods to use it.
You can use a subnet overlapping with the main local network. This is only a wayconfiguration issue and does not need additional helper programs. This makes it more stable and less error prone. But it requires some more know how about subnets to configure it and to understand how it works. And it has some restrictions in using ip address ranges, but this doesn't matter in most cases. You will see.
There are also helper programs available that makes usage of ip address ranges more flexible but it is more sensible with correct configuration and stability. If ip address ranges doesn't matter I would prefer the subnetting method.
#############################################################################
PROXY ARP WITH SUBNETTING (recommended)
Example Setup
┌─proxy arp─┐ UPLINK wired V ║ V wifi wan laptop <────────────> (eth0)RPi(wlan0) <~.~.~.~.> hotspot <---> INTERNET \ ╱ ║ ╲ (dhcp from 192.168.50.241 ║ (dhcp from hotspot) RPi) ║ ║ subnet: 192.168.50.240/28 ║ 192.168.50.0/24 As you can see, we have two subnets:
the main subnet (local WiFi network): 192.168.50.0/24 ip addresses: 192.168.50.1 to 192.168.50.254 = 254 ip addresses broadcast address: 192.168.50.255 the wired subnet: 192.168.50.240/28 ip addresses: 192.168.50.241 to 152.168.50.254 = 14 ip addresses broadcast address: 192.168.50.255 Have in mind that you cannot use the first network address and the last broadcast address of each subnet. For details on subnets look at Wikipedia - Subnetwork.
For proxy arp it is important that the smaller wired subnet is a subset of the main subnet and that it fits to the correct boundaries of possible subnets in the main subnet. I have set it upto the end of the main subnet. With this example we can address 14 devices on the wired subnet. If you need more or less simply use a bigger or smaller wired subnet. To calculate the subnet I use this IP Calculator but there are some others. Use your own favorite one.
So we have this overlapping:
0 |240 255 main subnet: |N------------------------------------------------B| wired subnet: |N---------B| Here you can see that a device on the main subnet can also broadcast for ip addresses 241 to 254. If you ensure - and that is important - that there are no devices on the main subnet having these addresses, the RasPi can use proxy arp to reply to the broadcast for an ip address instead of the device on the wired subnet, which isn't direct addressable from the main subnet. The RasPi works as proxy for the arp request. Please note that this has nothing to do with routing using ip addresses. It only works with mac addresses. That is also the reason why this only works on local area networks with one main subnet (broadcast domain).
Again, you must ensure that there are no devices on the main subnet using the ip addresses from the wired subnet. If using a DHCP server you must exclude this ip range from its address pool.
Now with this background information let's configure the RasPi. To simplify things I will use systemd-networkd.
Tested with
Raspberry Pi OS (32-bit) Lite 2020-05-27 on a Raspberry Pi 4B updated at 2020-08-19.
Updates done with sudo apt update && sudo apt full-upgrade && sudo reboot.
Switch over to systemd-networkd
Just follow to Use systemd-networkd for general networking. You can use section ♦ Quick Step. Then come back here.
Configure the WiFi client connection
Create this file for wpa_supplicant with your settings for country=, ssid= and psk=:
rpi ~$ sudo -Es # if not already done rpi ~# cat > /etc/wpa_supplicant/wpa_supplicant-wlan0.conf <<EOF country=DE ctrl_interface=DIR=/run/wpa_supplicant GROUP=netdev update_config=1 network={ ssid="TestNet" psk="testingPassword" } EOF rpi ~# chmod 600 /etc/wpa_supplicant/wpa_supplicant-wlan0.conf rpi ~# systemctl disable wpa_supplicant.service rpi ~# systemctl enable [email protected] rpi ~# rfkill unblock 0 We have to enable promiscuous mode on wlan0 to see broadcasts on both subnets. Edit the wpa_supplicant.service with:
rpi ~# sudo systemctl edit [email protected] In the empty editor insert these statements, save them and quit the editor:
[Service] ExecStartPre=/sbin/ip link set %i promisc on ExecStopPost=/sbin/ip link set %i promisc off Configure interfaces
Create these two files.
rpi ~# cat > /etc/systemd/network/04-wired.network <<EOF [Match] Name=e* [Network] # Have attention to the bit mask at the end of the address Address=192.168.50.241/28 # or just the smallest possible subnet with 2 ip addresses #Address=192.168.50.253/30 # or the half of the main subnet with 126 ip addresses #Address=192.168.50.129/25 DHCPServer=yes [DHCPServer] DNS=84.200.69.80 1.1.1.1 EOF rpi ~# cat > /etc/systemd/network/08-wifi.network <<EOF [Match] Name=wl* [Network] DHCP=yes IPForward=ipv4 IPv4ProxyARP=yes EOF Reboot.
That's it.
#############################################################################
PROXY ARP WITH HELPER PROGRAMS
In general I followed the tutorial (2). Have a look at it for the background.
First do ♦ General Setup (look at the end).
Because we will monitor the state of the inerfaces wlan0 and eth0 we have to use a program that will report changes. For this I have made the ifplug.service.
I will use systemd-networkd for reasons so first we have to switch over to it. For detailed information look at (1). Here only in short. Execute these commands:
To configure wpa_supplicant create this file with your settings for country=, ssid= and psk=. You can just copy and paste this in one block to your command line beginning with cat and including EOF (delimiter EOF will not get part of the file):
We have installed dhcp-helper, a proxy to get ip addresses from the wifi network, and parprouted that manages proxy arp.
references:
[1] Howto migrate from networking to systemd-networkd with dynamic failover
[2] Bridging Network Connections with Proxy ARP
[3] ProxyARP Subnetting HOWTO