Great question — answering as the UphillTech team:
Just adding firewall rules won't be enough for this one. You want the system to route traffic as if it was two independent systems that just happen to share the same hardware and processes: that's what the Strong ES Model effectively is. When aiming for Strong ES Model in Linux, you'll first need these sysctl settings: net.ipv4.conf.all.arp_filter=1 net.ipv4.conf.all.arp_ignore=1 # or even 2 net.ipv4.conf.all.arp_announce=2 These settings will make ARP behave as appropriate with the Strong ES Model, i.e. when an ARP request is received, only the interface with the exact requested address will answer, and only if traffic to the originating address would in fact be sent out through that...
Full answer by telcoM: https://unix.stackexchange.com/a/411339 (CC BY-SA 4.0).
Need it done for your business? UphillTech.
