Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DHCP Static Mapping not working on 2.7.0-release

    Scheduled Pinned Locked Moved General pfSense Questions
    14 Posts 5 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @ffe
      last edited by johnpoz

      @ffe how is you think something with static arp wouldn't be able to get to the internet?

      Are you saying 192.168.1.100 that has a static arp setting of mac abc, is being used by something with mac xyz?

      Could you clarify exactly what is happening or not happening? How are you wanting to use a static arp entry to block internet.. All a static arp does is set 192.168.1.100 to some specific mac abc for example.

      staticarp.jpg

      What exactly do you have checked about static arp?

      checked.jpg

      And who is using the internet - if something has static arp, it would have internet unless you blocked that IP in your firewall rules.

      Are you saying you have static arp for 192.168.1.100 mac abc, but something else has 192.168.1.200 with mac xyz and doesn't have a static arp entry? And is still able to talk to pfsense?

      That second static arp entry is to prevent arp entries for anything that is not static.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      F 2 Replies Last reply Reply Quote 1
      • F
        ffe @johnpoz
        last edited by

        @johnpoz for what i understand that were mac filtering, when the Static ARP is enable, that only host that are on the DHCP Static Mapping on the LAN will be able to access the net and anything else will be block from accessing the net but will
        still be able to grab an ip from the dhcp range and connect with other clients on the lan, it was working fine until we updated to
        2.7.0

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by stephenw10

          Hmm, no that's not what static ARP entries do. You can disable other dhcp leases so only static mappings can connect.

          F 1 Reply Last reply Reply Quote 0
          • F
            ffe @johnpoz
            last edited by

            @johnpoz said in DHCP Static Mapping not working on 2.7.0-release:

            Are you saying you have static arp for 192.168.1.100 mac abc, but something else has 192.168.1.200 with mac xyz and doesn't have a static arp entry? And is still able to talk to pfsense?

            Yes this is also happening, we manually assign a static ip on a client and it was able to access the net too

            johnpozJ 1 Reply Last reply Reply Quote 0
            • F
              ffe @stephenw10
              last edited by

              @stephenw10 are there any steps to do that, i may have skip something

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @ffe
                last edited by

                @ffe said in DHCP Static Mapping not working on 2.7.0-release:

                we manually assign a static ip on a client and it was able to access the net too

                Yeah unless you blocked the IP in the firewall - sure it would have internet. That static arp check box would prevent pfsense talking to anything it doesn't have a arp entry for.

                But just because something doesn't get an IP in the correct network from dhcp doesn't mean it wouldn't be able to talk to pfsense. If it can talk to pfsense and you don't want it to have internet, you would need to block that IP in your firewall rules.

                Now if you set pfsense to only talk to things in its arp table.. And this IP mac pair is not in pfsense arp table - then no it would be able to talk to pfsense and get internet.

                Take a look in your arp table on pfsense. If something is there, and its the correct pair then it would have internet unless you blocked it via a firewall rule.

                I think there is just some misunderstanding of what static arp is and can do.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Setting a static DHCP mapping with or without static ARP does not in any way block or pass traffic. You would also need to set firewall rules to do that. Nothing has changed in 2.7 in that respect.

                  Steve

                  P 1 Reply Last reply Reply Quote 0
                  • P
                    pcready.cl @stephenw10
                    last edited by

                    @stephenw10 said in DHCP Static Mapping not working on 2.7.0-release:

                    Setting a static DHCP mapping with or without static ARP does not in any way block or pass traffic. You would also need to set firewall rules to do that. Nothing has changed in 2.7 in that respect.

                    Steve

                    Hi, you dont understand, ARP Table allow spoofing now...

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • P
                      pcready.cl
                      last edited by pcready.cl

                      Same problem here with PFSENSE 2.7.2 CE and PFSENSE+ 24.03-RELEASE

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @pcready.cl
                        last edited by

                        @pcready-cl said in DHCP Static Mapping not working on 2.7.0-release:

                        ARP Table allow spoofing now...

                        Now ? That's possible since Ethernet (networking) exists.
                        I can set any MAC or IP on any device I want.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          What exactly are you seeing?

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.