diff -ur v2.4.23/linux/include/linux/in_route.h linux/include/linux/in_route.h
--- v2.4.23/linux/include/linux/in_route.h	1998-06-12 08:52:33.000000000 +0300
+++ linux/include/linux/in_route.h	2003-11-16 16:59:08.816465800 +0200
@@ -13,6 +13,7 @@
 #define RTCF_DIRECTDST	0x00020000
 #define RTCF_REDIRECTED	0x00040000
 #define RTCF_TPROXY	0x00080000
+#define RTCF_NOARP	0x00100000
 
 #define RTCF_FAST	0x00200000
 #define RTCF_MASQ	0x00400000
diff -ur v2.4.23/linux/include/linux/rtnetlink.h linux/include/linux/rtnetlink.h
--- v2.4.23/linux/include/linux/rtnetlink.h	2003-11-16 15:40:06.000000000 +0200
+++ linux/include/linux/rtnetlink.h	2003-11-16 17:00:58.675764648 +0200
@@ -168,6 +168,7 @@
 #define RTM_F_CLONED		0x200	/* This route is cloned		*/
 #define RTM_F_EQUALIZE		0x400	/* Multipath equalizer: NI	*/
 #define RTM_F_PREFIX		0x800	/* Prefix addresses		*/
+#define RTCF_NOARP		0x1000	/* Disable ARP for this route	*/
 
 /* Reserved table identifiers */
 
@@ -316,6 +317,7 @@
 /* ifa_flags */
 
 #define IFA_F_SECONDARY		0x01
+#define IFA_F_HIDDEN		0x02
 
 #define IFA_F_DEPRECATED	0x20
 #define IFA_F_TENTATIVE		0x40
diff -ur v2.4.23/linux/net/ipv4/arp.c linux/net/ipv4/arp.c
--- v2.4.23/linux/net/ipv4/arp.c	2003-11-16 15:40:07.000000000 +0200
+++ linux/net/ipv4/arp.c	2003-11-16 16:59:08.822464888 +0200
@@ -66,6 +66,7 @@
  *		Alexey Kuznetsov:	new arp state machine;
  *					now it is in net/core/neighbour.c.
  *		Krzysztof Halasa:	Added Frame Relay ARP support.
+ *		Julian Anastasov:	Per-route ARP control
  */
 
 #include <linux/types.h>
@@ -322,11 +323,24 @@
 	struct net_device *dev = neigh->dev;
 	u32 target = *(u32*)neigh->primary_key;
 	int probes = atomic_read(&neigh->probes);
+	struct rtable *rt;
 
-	if (skb && inet_addr_type(skb->nh.iph->saddr) == RTN_LOCAL)
-		saddr = skb->nh.iph->saddr;
-	else
-		saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
+	/* Determine source IP for the probing packet. */
+	saddr = 0;
+	if (skb != NULL) {
+		rt = (struct rtable*)skb->dst;
+		if (rt && !rt->rt_iif && !(rt->rt_flags & RTCF_NOARP))
+			saddr = rt->rt_src;
+	}
+	if (!saddr) {
+		if (ip_route_output(&rt, target, 0, 0, dev->ifindex) < 0)
+			/* Never send probes with 0 source as we used to. */
+			return;
+		saddr = rt->rt_src;
+		ip_rt_put(rt);
+	}
+	if (!saddr)
+		return;
 
 	if ((probes -= neigh->parms->ucast_probes) < 0) {
 		if (!(neigh->nud_state&NUD_VALID))
@@ -346,20 +360,35 @@
 		read_unlock_bh(&neigh->lock);
 }
 
-static int arp_filter(__u32 sip, __u32 tip, struct net_device *dev)
+static int arp_filter(struct sk_buff *skb, __u32 sip, __u32 tip,
+		struct in_device *in_dev)
 {
 	struct rtable *rt;
 	int flag = 0; 
-	/*unsigned long now; */
 
+	if (!IN_DEV_ARPFILTER(in_dev))
+		return 0;
+
+	/* Always answer direct queries. */
+	if (skb->pkt_type == PACKET_HOST)
+		return 0;
+
+	/* Then check routes:
+	 * primarily, this check is used to not to answer to some requests if
+	 * several interfaces are connected to the same segment.
+	 * This check also may be used for manual control of who sees IP
+	 * addresses at which link-level addresses by installing prohibiting
+	 * routes.  -- 2001/05/20  SAW
+	 */
 	if (ip_route_output(&rt, sip, tip, 0, 0) < 0) 
 		return 1;
-	if (rt->u.dst.dev != dev) { 
+	if (rt->u.dst.dev != in_dev->dev) { 
 		NET_INC_STATS_BH(ArpFilter);
 		flag = 1;
 	} 
 	ip_rt_put(rt); 
-	return flag; 
+
+	return flag;
 } 
 
 /* OBSOLETE FUNCTIONS */
@@ -770,10 +799,8 @@
 		if (addr_type == RTN_LOCAL) {
 			n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
 			if (n) {
-				int dont_send = 0;
-				if (IN_DEV_ARPFILTER(in_dev))
-					dont_send |= arp_filter(sip,tip,dev); 
-				if (!dont_send)
+				if (!(rt->rt_flags & RTCF_NOARP) &&
+				    !arp_filter(skb, sip, tip, in_dev))
 					arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
 
 				neigh_release(n);
@@ -787,6 +814,9 @@
 				if (n)
 					neigh_release(n);
 
+				if (rt->rt_flags & RTCF_NOARP)
+					goto out;
+
 				if (skb->stamp.tv_sec == 0 ||
 				    skb->pkt_type == PACKET_HOST ||
 				    in_dev->arp_parms->proxy_delay == 0) {
diff -ur v2.4.23/linux/net/ipv4/fib_frontend.c linux/net/ipv4/fib_frontend.c
--- v2.4.23/linux/net/ipv4/fib_frontend.c	2003-08-25 22:06:13.000000000 +0300
+++ linux/net/ipv4/fib_frontend.c	2003-11-16 16:59:08.823464736 +0200
@@ -445,6 +445,9 @@
 	req.rtm.rtm_protocol = RTPROT_KERNEL;
 	req.rtm.rtm_scope = (type != RTN_LOCAL ? RT_SCOPE_LINK : RT_SCOPE_HOST);
 	req.rtm.rtm_type = type;
+	if (ifa->ifa_flags & IFA_F_HIDDEN && type == RTN_LOCAL &&
+	    cmd == RTM_NEWROUTE)
+		req.rtm.rtm_flags |= RTM_F_NOARP;
 
 	rta.rta_dst = &dst;
 	rta.rta_prefsrc = &ifa->ifa_local;
diff -ur v2.4.23/linux/net/ipv4/route.c linux/net/ipv4/route.c
--- v2.4.23/linux/net/ipv4/route.c	2003-11-16 15:40:07.000000000 +0200
+++ linux/net/ipv4/route.c	2003-11-16 16:59:08.829463824 +0200
@@ -1484,6 +1484,9 @@
 	if (res.type == RTN_BROADCAST)
 		goto brd_input;
 
+	if (res.fi && res.fi->fib_flags & RTM_F_NOARP)
+		flags |= RTCF_NOARP;
+
 	if (res.type == RTN_LOCAL) {
 		int result;
 		result = fib_validate_source(saddr, daddr, tos,
@@ -1921,6 +1924,9 @@
 	if (res.type == RTN_NAT)
 		goto e_inval;
 
+	if (res.fi && res.fi->fib_flags & RTM_F_NOARP)
+		flags |= RTCF_NOARP;
+
 	if (res.type == RTN_LOCAL) {
 		if (!key.src)
 			key.src = key.dst;
@@ -2124,6 +2130,8 @@
 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
 	if (rt->rt_flags & RTCF_NOTIFY)
 		r->rtm_flags |= RTM_F_NOTIFY;
+	if (rt->rt_flags & RTCF_NOARP)
+		r->rtm_flags |= RTM_F_NOARP;
 	RTA_PUT(skb, RTA_DST, 4, &rt->rt_dst);
 	if (rt->key.src) {
 		r->rtm_src_len = 32;
@@ -2248,6 +2256,8 @@
 	skb->dst = &rt->u.dst;
 	if (rtm->rtm_flags & RTM_F_NOTIFY)
 		rt->rt_flags |= RTCF_NOTIFY;
+	if (rtm->rtm_flags & RTM_F_NOARP)
+		rt->rt_flags |= RTCF_NOARP;
 
 	NETLINK_CB(skb).dst_pid = NETLINK_CB(in_skb).pid;