I have proxy arp running across eth0/eth1 (external/dmz) and am using the same subnet across both interfaces. In order to get this to work I have to clear the SPOOF_DROP set of rules.

Can you advise the correct place that I should place:

iptables -F SPOOF_DROP -t nat

under ASL 4.020 so that the rule set is flushed every time I boot the box?

Thanks in advance!

Maybe this link
answer your question.
Cheers Bagira

Thanks ... I was after a definitive answer and that post seems to alude to a v3.2.x configuration.

On that note (and the doco seems to be completely devoid of any instruction on correctly configuring proxyarp bridged interfaces) is the correct method to:

Set proxyarp on eth0 (untrusted) and eth1 (DMZ)
Set eth0 to public IP + netmask + default route
Set eth1 to arbitrary IP + netmask
Set static interface routes for each IP within DMZ
Set packet filter rule sets for each IP within DMZ

Is this the preferred method? I also tested by setting the IP + Netmask + Default Route of both eth0 and eth1 identically. This obviated the need for the interface routes.

In both cases the need to hand configure the firewall and flush the SPOOF_DROP table renders the configuration incomplete (ie. proxy arp bridges cannot be configured via WebAdmin alone).

Is this an oversite in WebAdmin?