Do there perhaps already exist a command in VyOS to solve the below usecase?
Usecase:
eth0: WAN-interface.
eth1: LAN-interace.
eth0 is configured with 192.168.1.1/24.
eth0 is using default gateway 192.168.1.254.
You will SNAT a particular outgoing traffic at eth0 to 192.168.1.2 (basically do a 1:1 NAT since you will also SNAT another LAN-host to 192.168.1.3).
If you enable proxy-arp or local-proxy-arp on eth0 your VyOS box will then send arp replies for all IP-addreses of 192.168.1.0/24.
This is bad because in this usecase there are other devices available on the 192.168.1.0/24 network except for your VyOS and the gateway it uses. The other devices will be interrupted when this VyOS box is sending arp-replies in their name. Other boxes will detect this as IP-collissions and/or ARP-spoofing attack.
Solution:
You want to limit VyOS to proxy-arp only for 192.168.1.2 and 192.168.1.3 for arp-requests arriving at eth0.
Manually this could be achieved through following command, prefered if similar could be done through vyos-config:
```
/sbin/arp -i eth0 -Ds 192.168.1.2 eth0 pub
```
Would be prefered if the vyos-config syntax would involve not only physical interfaces but also vlan interfaces (vif) and tunnel interfaces.
Ref:
https://tldp.org/HOWTO/Proxy-ARP-Subnet/setup.html
https://manpages.debian.org/bookworm/net-tools/arp.8.en.html