Pfsense giving out wrong range IP-adresses

qradmin

Dear pfsense users

I am having problems with my pfsense 2.1 (i386) giving out IP-adresses in a wrong range.

The procedure is as follows:

A device asks for an IP
PFsense often gives out an IP in a totally different range than it's normally set to (set to 10.10.0.10-10.10.9.255). Internet is not accessible when this happens.
If you get your device to ask for a new lease, you will get a IP in the correct range.

MAC-passthrough is enabled, so the devices asking for IP's are in the mac passthrough list (several hundreds listed). The funny thing is that devices registered with a static IP in 'DCHP server' don't experience the issue.

I am using pfsense on a server with the following setup:
WAN -> ISP router (DCHP disabled) -> Pfsense server (DCHP enabled) -> 3 switches -> 60 cabled users.

I have been wondering whether pfsense or the ISP router is the source of the problem, but I have no clue how to find out. Does anyone know how I can proceed from here? If you need more information, please ask and i will update the post with it.

Thank you very much,

Rune

mikeisfly

When you get a wrong IP what range is it set to? What is the default gateway when you get the wrong IP? Seems like you have a two DHCP servers on the same network some where. Are you using VLANs? Maybe someone plugged one vlan into another or hooked up a residential NAT router somewhere? I would find out what the IP address of the gateway is when you get the wrong address. Then use your arp table (arp -a, is the command on most operating systems) to see what the mac address is of that gateway. Then log into your switches (hopefully they are managed) and hunt the offending MAC down and that should reveal your answer.

johnpoz

^ agreed.. The output of any windows box of ipconfig /all will list the IP address of the dhcp server it got the lease from as well.

It seems very very unlikely that pfsense would just hand out some other range - what is more likely is you have a rouge dhcp server running. Anyone that brought in a home router, or if someone reset a wireless router you were using as a AP, etc..

qradmin

Thank you both for your helpful replies! I totally agree it seems like a rogue NAT-router has been set up somewhere, because the portal I'm taken too when I get an IP in the wrong range is equal to the login-page of one of the popular ISP residential NAT-routers.

The switches are manageable, so i should be able to track down the router, but "unfortunately" it seems it has been taken off the network again - I haven't been able to get connected to the wrong IP-range since i posted the message. Though it's good the problem has apparently been solved, it would have been nice to catch the router after months of annoyance :)

Anyway, now I know how to handle it the next time someone plugs in a NAT-router, so thank you both!

Rune