How does the ARP table work in case of the Gateway Router?

Question

Suppose I am a host, I understand how ARP works in case I address an IP within my subnet. For each IP address there is a corresponding MAC address, and the owner responds to my broadcast ARP query. However, for external IPs, my ARP table is actually not one to one.

Does ARP work this way in this case: 1-Host broadcasts an external IP address to the subnet asking who this is, 2- gateway router responds with its MAC, 3- For another external IP the process repeats again and again...

In this case, how does the router know that it should respond all these different external addresses with its own MAC?

Answer 1

You've got a misconception there:

Does ARP work this way in this case: 1-Host broadcasts an external IP address to the subnet asking who this is, 2- gateway router responds with its MAC, 3- For another external IP the process repeats again and again...

It doesn't work that way. The usual case for hosts is much simpler: it uses its own IP address and network mask to decide if the target IP address is local or not. If local, then it uses ARP to resolve the MAC address, if remote it uses ARP to resolve the MAC address of the default gateway. Then it sends the packet. ("Uses ARP" = look in cache, if not found, make ARP request, wait for ARP response.)

Hosts with many interfaces do the "is-it-local" test for each interface. Hosts with many routes decide which gateway is next-hop depending on target IP address.

There is a technique which is like what you are thinking of, called "proxy ARP". Others tell me in comments it's still current, but personally I haven't seen used in anger for over 20 years. In this scheme you tell the gateway to respond to ARP requests for other hosts. Details in RFC 1027 and Cisco doc.

Answer 2

Proxy-ARP is often used by routers performing NAT, when listening for forwarded IP blocks in a different subnet to the WAN interface itself.

For example, your router might have a public IP of 1.1.1.1/30 and your ISP has given you 1.3.1.1/28 (1.3.1.1-1.3.1.14 OR 14 usable hosts) as a block of IPs to use for services of your choosing. Your firewall/router may then instigate proxy-ARP to respond to the forwarded traffic from that block, even though it's a separate subnet to the WAN interface (1.1.1.1-1.1.1.2 OR 2 usable hosts).

Juniper's example is something like:

set security nat proxy-arp interface reth1.0 address 1.3.1.1/28

to get interface 'reth1.0' (acting as WAN, using IP 1.1.1.1) to listen/respond to requests for the 1.3.1.1/28 range.