[strongSwan] farp plugin with two partially overlapping networks

Martin Willi martin at strongswan.org
Fri May 17 09:07:49 CEST 2013

Hi Anton,

> ( - main NET1)--[Main VPN gateway]=={internet}==[office VPN gateway]--( - office NET2)

> Is it possible to use farp plugin for this task ?

The farp plugin is actually very simple; it fakes ARP responses to
itself for any request that:

      * comes from a "leftsubnet"
      * asks for an address in "rightsubnet"

If you tunnel exactly your subnets, i.e. (main) ==== (office)

main will reply to ARP requests from targeting, office will reply for requests from

In main this should work fine; however in office you have a serious
problem: local hosts that would like to find local hosts send ARP
requests that farp will reply to.

To fix that, you should try to avoid that overlap in the tunneled
subnets (which is a good idea anyway). IKEv2 does not allow you to
"exclude" a subnet, but you can use multiple subnets, something like:, ====

On all clients in office, you'll have to make sure they issue ARP
requests for, i.e. have configured an appropriate subnet
mask (using DHCP, for example).


More information about the Users mailing list