I give up! I need help to solve this problem.

Question

Just a heads up you will need coffee.
Please this is driving me mad and I cannot solve it I really, really can't! So here it is in a nutshell because I'm done! With trying to solve this by myself because clearly I'm not getting it.
So here is my understanding in short say 101 of networking put simply just as a base of understanding..... you get a IP from your ISP with a gateway IP in a subnet range and within that range you ARP to send from your IP to another IP in that range for the MAC (technically this MAC can still be the ISP gateway MAC and route by IP without knowing MAC for that other IP in your subnet but....works either way) and to send from your IP to an IP out side the subnet your in you send to the ISP gateway MAC where it will be routed.
This is from windows 7 and when you ARP that MAC e6-1f-6d-6c-db-da is my ISP for all of 10. for all of 172.16. to 172.31. for all of 192.168. and 169.254. replys with that MAC every-single-one! From a request by ARP IP sender like 77.96.238.3 (if that was my IP) in 255.255.254.0 for them target IP's! (except the ones in the subnet of the subnet your in) The reply comes from my ISP gateway basically saying for sending to IP's in 10. for all of 172.16. to 172.31. for all of 192.168. and 169.254. is over where my ISP gateway IS! ITS NOT!
C:\Windows\system32>arp -a
Interface: 77.96.238.3 --- 0x13
Internet Address    Physical Address      Type
10.0.0.1                e6-1f-6d-6c-db-da      dynamic ]< NOT
10.0.0.2                e6-1f-6d-6c-db-da      dynamic ]<-NOT
10.0.0.3                e6-1f-6d-6c-db-da      dynamic ]<-NOT
10.0.0.4                e6-1f-6d-6c-db-da      dynamic ]<-NOT
77.96.238.1           e6-1f-6d-6c-db-da      dynamic      }-OK
77.96.238.2           9d-d3-6d-4d-ad-c5      dynamic     }-OK
77.96.238.4           20-8e-f2-0a-ef-c1      dynamic       }-OK
77.96.238.5           4c-d3-3d-cd-7f-cd      dynamic      }-OK
77.96.238.6           80-e5-2a-c4-7e-31      dynamic     }-OK
77.96.239.0           0c-b0-5d-09-d5-01      dynamic     }-OK
77.96.239.2           50-1f-33-4b-bd-05      dynamic      }-OK
77.96.239.3           8c-b0-5d-15-d0-79      dynamic     }-OK
77.96.239.4           1c-d3-6d-ea-5c-0d      dynamic     }-OK
77.96.239.5           60-e5-2a-c8-94-59      dynamic     }-OK
172.16.0.0           e6-1f-6d-6c-db-da      dynamic ]< NOT
172.16.0.1           e6-1f-6d-6c-db-da      dynamic ]<-NOT
172.16.0.2           e6-1f-6d-6c-db-da      dynamic ]<-NOT
172.16.0.3           e6-1f-6d-6c-db-da      dynamic ]<-NOT
192.168.0.0         e6-1f-6d-6c-db-da      dynamic ]<-NOT
192.168.0.1         e6-1f-6d-6c-db-da      dynamic ]<-NOT
192.168.0.2         e6-1f-6d-6c-db-da      dynamic ]<-NOT
192.168.0.3         e6-1f-6d-6c-db-da      dynamic ]<-NOT
224.0.0.22           01-00-5e-00-00-16     static
224.0.0.252         01-00-5e-00-00-fc      static
224.1.1.1             01-00-5e-01-01-01     static
255.255.255.255   ff-ff-ff-ff-ff-ff                static
The XP TCP/IP stack does not do this and you might think that my windows 7 has a problem it does not because the TCP/IP stack in windows 7 is a rebuild of what the TCP/IP stack was like in XP but whats done is done and that how the windows 7 TCP/IP stack is and that should be a eye opener as to why nothing has been done about this but thats just me saying that but its not really a TCP/IP stack problem. So is that my ISP problem? The answer is no because even if my ISP did not reply you still can send requests from a valid IP like 77.96.238.3 to your ISP a ARP with a target IP that does not and should not exist out to your ISP gateway like 192.168.0.1 yet you can.
The simple fact is this there is no, none and nothing to make a ACL for ARP to drop the target/sender IP's for the 0806 Ethertype.
And I have tried this Dynamic ARP Inspection with both DHCP Snooping/Relay and ARP Inspection in a two port VLAN on the right port for this Trusted Interface to be on and Enabled VLANs for ARP Inspection is set with ARP Inspection Status & ARP Packet Validation enabled and in DHCP Snooping/Relay with DHCP Snooping Status & Verify MAC Address enabled and VLAN set for DHCP Snooping. Does not stop this.
Maybe just maybe if the DHCP Snooping looked at the Option 1 & 3 for the Subnet Mask & Router to know the range that the ARP Inspection can drop ARP for target IP's outside that range because like I said to send from your IP to an IP outside the subnet your in you send to the ISP gateway MAC where it will be routed only then would that Dynamic ARP Inspection work as I was hoping for but sadly no.
So please tell me why I can't simply drop ARP for given target/sender IP's is their another way (and NAT is not a solution) that ideally makes ARP for from 77.96.238.3 as the sender for a request for a target IP of 10. for all of 172.16. to 172.31. for all of 192.168 and 169.254. NOT reach my ISP BUT allows ARP from 77.96.238.3 as the sender for a request for a target IP within the given subnet to my ISP for a reply.
A million THANK YOU to anyone for helping me with this

Answer 1

I really do not get why providing a config would help because if you have a config that does what I need should it not be you to provide a config or tell me how? Why not tell me how if you know how? because I need to understand how if you know what I need to do.
But here is how its setup:
Administration
System Mode L3
VLAN Management
Default VLAN Settings 20
GE1-GE7 and GE10 VLAN 20 Trunk Untagged with GE8-GE9 Forbidden
GE8-GE9 VLAN 10 Trunk Untagged with GE1-GE7 and GE10 Forbidden
IP Configuration
IPv4 Interface VLAN 20 Static 192.168.1.254 255.255.255.0 Valid
DHCP Snooping/Relay
DHCP Snooping Status: Enable - ticked
Verify MAC Address: Enable - ticked
Interface Settings
VLAN 10 DHCP with Snooping Enable - ticked
DHCP Snooping Trusted Interfaces
GE9 Trusted Interface Yes
GE1-GE8 and GE10 Trusted Interface No
ARP Inspection
ARP Inspection Status: Enable - ticked
ARP Packet Validation: Enable- ticked
Interface Settings
GE9 Trusted Interface Yes
GE1-GE8 and GE10 Trusted Interface No
VLAN Settings
Enabled VLANs VLAN 10
Access Control
IPv4-Based ACL – note this is based on Ethertype 0800 it will not help me drop ARP which is Ethertype 0806 this really does not help it really does not but works for 0800 not for 0806 Ethertype.
Dropsetin
Dropsetintoout
IPv4-Based ACE for Dropsetin
Priority---------Action--Protocol------Source IP Address----------Destination IP Address
100--------------Deny---Any (IP)------Any-----------Any --------------192.168.0.0--0.0.255.255
101--------------Deny---Any (IP)------192.168.0.0--0.0.255.255-------Any----------Any
102--------------Deny---Any (IP) -----Any------------Any--------------10.0.0.0-------0.255.255.255
104--------------Deny---Any (IP)------Any------------Any--------------172.16.0.0----0.15.255.255
105--------------Deny---Any (IP)------172.16.0.0----0.15.255.255----Any------------Any
106--------------Deny---Any (IP)------Any------------Any--------------169.254.0.0---0.0.255.255
107--------------Deny---Any (IP)------169.254.0.0---0.0.255.255-----Any------------Any
2147483647---Permit--Any (IP) -----Any------------Any---------------Any-----------Any
IPv4-Based ACE for Dropsetintoout
Priority---------Action--Protocol------Source IP Address----------Destination IP Address
100--------------Deny---Any (IP)------Any-----------Any --------------192.168.0.0--0.0.255.255
101--------------Deny---Any (IP)------192.168.0.0--0.0.255.255-------Any----------Any
102--------------Deny---Any (IP) -----Any------------Any--------------10.0.0.0-------0.255.255.255
103--------------Deny---Any (IP) -----10.0.0.0-------0.255.255.255---Any------------Any
104--------------Deny---Any (IP)------Any------------Any--------------172.16.0.0----0.15.255.255
105--------------Deny---Any (IP)------172.16.0.0----0.15.255.255----Any------------Any
106--------------Deny---Any (IP)------Any------------Any--------------169.254.0.0---0.0.255.255
107--------------Deny---Any (IP)------169.254.0.0---0.0.255.255-----Any------------Any
2147483647---Permit--Any (IP) -----Any------------Any---------------Any-----------Any
ACL Binding for Dropsetin
GE9
ACL Binding for Dropsetintoout
GE8
And added a IPv6-Based ACL not that thiers any piont yet.
And added rules for modem status Source IP 192.168.100.1 0.0.0.0 Source port 80 Dropsetin before 192.168.0.0 drop and Destination IP 192.168.100.1 0.0.0.0 Destination port 80 before 192.168.0.0 drop in Dropsetintoout 
Message was edited by: Peter __