Home ISP dmesg: arp <hw>is using my IP address <ip>on</ip></hw>
-
I've noticed my pfsense dmesg log is filled with these messages (HW and IP address removed)
arp: xx:xx:xx:xx:xx:xx is using my IP address yyy.yyy.yyy.yyy on igb3!This is happening because of how my ISP (AT&T) is configured. The igb3 interface is WAN on pfsense. The topology looks like this:
Internet <-> AT&T Router <-> Pfsense <-> Home Network
The AT&T router basically gives me 2 options for setting up my home network.
First is to do a double NAT. The ATT Router nat only to my pfsense router (forwarding all ports), and the pfsense nat again my home network.
Second is what they call "DMZ mode". The way this works is that both the AT&T router egress interface and my pfsense WAN interface both get the same public ip address. The AT&T lan interface gets an internal ip address on a different subnet than mine for configuring from inside. Then the AT&T somehow receives and forwards all packets to my pfsense box.
There doesn't appear to be any way to put the AT&T router into a pure bridge mode. It has to be double nat or this weird DMZ mode thing.
Because the AT&T router and my WAN interface both have the same ip, I'm getting the above arp messages spamming my dmesg.
So far, it appears this arp conflict is benign. I haven't noticed anything wrong with the network that I could trace back to this. Despite that, having the spam in dmesg is annoying.
Can you see any situation where this duplicated ip address could cause a problem? If not, is there anyway to disable this arp warning message in pfsense for the WAN interface?
Thanks!
-
Yeah. AT&T are idiots who do 802.1x authentication of their gateway, so you can't even buy a standard VDSL modem or hook up your own router to the ONT (Fibre)
Their IP pass-through mode still subjects you to NAT table limitations and that like, unfortunately. And I recall reading something about blocked ports.
I read something about extracting the certificate and the private key from the AT&T gateway with an exploit. Obviously not endorsed by AT&T though.
This looks interesting. I don't have AT&T so I can't comment but it might work. Don't know if pfSense has an ebtables equivalent.
http://blog.0xpebbles.org/Bypassing-At-t-U-verse-hardware-NAT-table-limits