Whenever my friend tries to connect to my network his router logs "Arp address mismatch - Ethernet source address doesn't match ARP sender address" and refuses the connection. It happens when he tries to connect a server on any computer and port behind my router. Other people can connect just fine and he can connect to other things just fine. What can we do about this issue? His router is a Draytek.
I did some Googling, and I discovered that your router is probably a Draytek, since that's the kind of device that produces the error you mentioned.
The problem is that, apparently, his device is replying to an ARP request with a different MAC address than the interface that sends the reply. Your router blocks such things by default because they can indicate an ARP Poison Routing attack.
To make the router accept such connections, you'll need to change its configuration. From a working machine, telnet into it by typing
telnet followed by the router's IP address into a command prompt. For instance, my router is at 192.168.1.1, so I would type
telnet 192.168.1.1. You'll be asked to log in; enter the information that the prompts ask for. Source: this Draytek guide.
Once you're in, issue the command
ip arp accept 1. That will disable the ARP check that's giving you trouble. Source: another Draytek article. If, in the future, you need to turn the protection back on, do the same command but with a
0 at the end.
In addition to the command mentioned by Ben M, I found I needed to also enter
sys commit so that the change survived reboots of my Draytek.
sys commit saves to flash instead of SRAM but it would be recommended to try the setting out before doing so in case it breaks things. If it breaks, you simply restart the router to go back to normal but, if you've committed the changes, you may have to reset.
Thanks for the answer, helped out a lot!