Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    MAC address spoofing on VLAN's and impressions from a second-try user

    Scheduled Pinned Locked Moved General pfSense Questions
    30 Posts 13 Posters 6.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Aaargh
      last edited by

      @awebster:

      But it is supported by the underlying hardware, so this is a failure of the underlying OS.

      FreeBSD, the underlying OS, is not pfSense.  If you want the underlying OS to support the hardware the way you want it to, I suggest you take that up in the FreeBSD forums.

      PFSense made the decision to build their stuff on top of FreeBSD. PFSense as a whole is the product they are selling, who supplies their parts is not my concern. All I see as an end-user is that PFSense as a product can not support my fairly trivial use-case. It's also lacking support for other essential features. E.g. no support for fq_codel.  It looks to me like PFSense as a router OS is still a bit of a toy and not a real serious product.

      1 Reply Last reply Reply Quote 0
      • dotdashD
        dotdash
        last edited by

        Dude,
        I'm sorry that something that you got completely free didn't work for your home setup. You could just go back to your Linux box and call it a day instead of starting a troll thread. While it would be good to support this, getting dhcp on two vlans has never been a requirement in any business case I've seen. If you think it's a toy, go ahead and use something else, but it works just fine for many others in home and business environments. I don't know why you want to keep checking back when you obviously think the software sucks.

        1 Reply Last reply Reply Quote 0
        • N
          Nullity
          last edited by

          @Aaargh!:

          @awebster:

          But it is supported by the underlying hardware, so this is a failure of the underlying OS.

          FreeBSD, the underlying OS, is not pfSense.  If you want the underlying OS to support the hardware the way you want it to, I suggest you take that up in the FreeBSD forums.

          PFSense made the decision to build their stuff on top of FreeBSD. PFSense as a whole is the product they are selling, who supplies their parts is not my concern. All I see as an end-user is that PFSense as a product can not support my fairly trivial use-case. It's also lacking support for other essential features. E.g. no support for fq_codel.  It looks to me like PFSense as a router OS is still a bit of a toy and not a real serious product.

          FYI, fq_codel is support will be included in pfSense 2.4, since it is based on FreeBSD 11 which added fq_codel.

          http://caia.swin.edu.au/freebsd/aqm/

          I understand that you have complaints (who doesn't?) but you seem like you are a bit more focused on finding reasons to complain rather than finding solutions to your problems.

          I'd be the first to say that Linux has more modern networking features and if that's what you want/need, there's nothing wrong with choosing Linux, but I am slightly confused with you saying unconstructive, trollish things like pfSense "is still a bit of a toy and not a real serious product".

          Please correct any obvious misinformation in my posts.
          -Not a professional; an arrogant ignoramous.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Can you not just set mac on a vlan like this?

            ifconfig vlan0 lladdr fe:e1:ba:d0:84:0e

            This would be a very unique case that you would need to do such a thing - but simple test shows it works

            [2.4.0-BETA][root@pfsense.local.lan]/root: ifconfig em2_vlan900
            em2_vlan900: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                    options=3 <rxcsum,txcsum>ether 00:50:56:00:00:03
                    inet6 fe80::250:56ff:fe00:3%em2_vlan900 prefixlen 64 scopeid 0xe
                    inet 192.168.99.253 netmask 0xffffff00 broadcast 192.168.99.255
                    nd6 options=21 <performnud,auto_linklocal>media: Ethernet autoselect (1000baseT <full-duplex>)
                    status: active
                    vlan: 900 vlanpcp: 0 parent interface: em2
                    groups: vlan
            [2.4.0-BETA][root@pfsense.local.lan]/root: ifconfig em2_vlan900 lladdr fe:e1:ba:d0:84:0e
            [2.4.0-BETA][root@pfsense.local.lan]/root: ifconfig em2_vlan900
            em2_vlan900: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                    options=3 <rxcsum,txcsum>ether fe:e1:ba:d0:84:0e
                    inet6 fe80::250:56ff:fe00:3%em2_vlan900 prefixlen 64 scopeid 0xe
                    inet 192.168.99.253 netmask 0xffffff00 broadcast 192.168.99.255
                    nd6 options=21 <performnud,auto_linklocal>media: Ethernet autoselect (1000baseT <full-duplex>)
                    status: active
                    vlan: 900 vlanpcp: 0 parent interface: em2
                    groups: vlan
            [2.4.0-BETA][root@pfsense.local.lan]/root:

            You would most likely need to do something or that would not survive a reboot.  I would just add a new nic if I need two different mac on the wan side of pfsense.</full-duplex></performnud,auto_linklocal></rxcsum,txcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud,auto_linklocal></rxcsum,txcsum></up,broadcast,running,simplex,multicast>

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • jahonixJ
              jahonix
              last edited by

              @johnpoz:

              Can you not just set mac on a vlan like this?

              Check it yourself … you'll find that only one of those MACs (last or first, I don't remember) gets used on all VLANs.

              1 Reply Last reply Reply Quote 0
              • V
                voxeljorz
                last edited by

                @jahonix:

                @johnpoz:

                Can you not just set mac on a vlan like this?

                Check it yourself … you'll find that only one of those MACs (last or first, I don't remember) gets used on all VLANs.

                It's the last VLAN MAC address used.

                1 Reply Last reply Reply Quote 0
                • R
                  Rai80
                  last edited by

                  I'm facing the same problem with my new ISP. This new ISP delivers internet on VLAN34 and IPTV on VLAN4. Both interfaces request an IP by DHCP. But they need there own MAC address to get on both VLAN's an IP address. To solve this I created a bridge and added 1 member interface. In my case for VLAN4. After creating the bridge you can change the MAC address of the bridge interface.

                  1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott
                    last edited by JKnott

                    What Linux distro makes it so easy to spoof MACs, let alone with different VLANs? I've been using Linux for over 20 years (currently openSUSE) and don't ever recall such a thing. While it may be possible with ifconfig or other utilities, spoofing the MAC isn't even included in the network settings, in openSUSE. Also, the only difference between a VLAN frame and a native LAN frame is the VLAN tag, which is included in the frame payload that's passed to the NIC. I don't know that there's any way to change the MAC, as that's done in the NIC, not in data fed to it. Has anyone else seen this in Linux or elsewhere?

                    In looking at the man page for the IF command (replacement for deprecated ifconfig), there is something called Virtual Function (VF), where things such as MAC or VLAN can be set, but no indication that the MAC can be set differently per VLAN.

                    BTW, is the ifconfig in Linux that different from the one in BSD?

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • R
                      Rai80
                      last edited by

                      For anyone looking or a solution/workaround to this. Add the following in the top section of /etc/inc/interfaces.inc:

                      mwexec("/sbin/ifconfig igb0 promisc");
                      mwexec("/sbin/ifconfig igb0.4 promisc");
                      mwexec("/sbin/ifconfig igb0.4 ether 00:aa:bb:cc:dd:ee");

                      1 Reply Last reply Reply Quote 2
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        You have actually confirmed that allows pulling two IPs via DHCP?

                        W 1 Reply Last reply Reply Quote 0
                        • R
                          Rai80
                          last edited by

                          Yes, I got 2 IP's!

                          1 Reply Last reply Reply Quote 2
                          • W
                            Wikai @stephenw10
                            last edited by

                            @stephenw10 said in MAC address spoofing on VLAN's and impressions from a second-try user:

                            You have actually confirmed that allows pulling two IPs via DHCP?

                            @Rai80 said in MAC address spoofing on VLAN's and impressions from a second-try user:

                            Yes, I got 2 IP's!

                            I can confirm this works!
                            I'm now using a single-NIC Intel NUC as my home router, pulling 5 IPs from my ISP via DHCP and even load-balancing over them (yes... my ISP messed up giving me 100/100 per IP :)).
                            For years I thought this wasn't possible with pfSense, believing it had to be run virtualized in order to pull this off. But here I am, running a single-NIC bare metal.
                            Thank you @Rai80.

                            JKnottJ 1 Reply Last reply Reply Quote 0
                            • JKnottJ
                              JKnott @Wikai
                              last edited by JKnott

                              @Wikai

                              Please show the output from ifconfig. If public addresses, feel free to edit the network part.

                              PfSense running on Qotom mini PC
                              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                              UniFi AC-Lite access point

                              I haven't lost my mind. It's around here...somewhere...

                              W 1 Reply Last reply Reply Quote 0
                              • G
                                GertJanT
                                last edited by GertJanT

                                I am not familiar with the promiscous option.
                                But what I read from this:
                                Usually, your network interfaces will only pass the packets they are programmed to pass to your CPU. In promiscuous mode, your network interfaces will catch every single packet it receives on an interface.

                                So, isn't here a performance downside to this usage?

                                1 Reply Last reply Reply Quote 0
                                • W
                                  Wikai @JKnott
                                  last edited by Wikai

                                  @JKnott
                                  Here you go.
                                  em0.10 - LAN vlan
                                  em0.101-105 WAN vlans

                                  Shell Output - ifconfig
                                  em0: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 mtu 1500
                                  	options=1209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWFILTER>
                                  	ether e4:ee:1a:xx:xx:xx
                                  	hwaddr c0:3f:d5:xx:xx:xx
                                  	inet6 fe80::xxxx:xxxx:xxxx:xxxx%em0 prefixlen 64 scopeid 0x1
                                  	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                  	media: Ethernet autoselect (1000baseT <full-duplex>)
                                  	status: active
                                  	
                                  em0.10: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                  	options=3<RXCSUM,TXCSUM>
                                  	ether e4:ee:1a:xx:xx:xx
                                  	inet6 fe80::xxxx:xxxx:xxxx:xxxx%em0.10 prefixlen 64 scopeid 0x6
                                  	inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
                                  	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                  	media: Ethernet autoselect (1000baseT <full-duplex>)
                                  	status: active
                                  	vlan: 10 vlanpcp: 0 parent interface: em0
                                  	groups: vlan
                                  	
                                  em0.101: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 mtu 1500
                                  	options=3<RXCSUM,TXCSUM>
                                  	ether 1c:b7:2c:xx:xx:xx
                                  	inet6 fe80::xxxx:xxxx:xxxx:xxxx%em0.101 prefixlen 64 scopeid 0x7
                                  	inet xxx.xxx.xxx.8 netmask 0xffffff00 broadcast xxx.xxx.xxx.255
                                  	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                  	media: Ethernet autoselect (1000baseT <full-duplex>)
                                  	status: active
                                  	vlan: 101 vlanpcp: 0 parent interface: em0
                                  	groups: vlan
                                  	
                                  em0.102: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 mtu 1500
                                  	options=3<RXCSUM,TXCSUM>
                                  	ether 1a:c9:8e:xx:xx:xx
                                  	inet6 fe80::xxxx:xxxx:xxxx:xxxx%em0.102 prefixlen 64 scopeid 0x8
                                  	inet xxx.xxx.xxx.17 netmask 0xffffff80 broadcast xxx.xxx.xxx.127
                                  	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                  	media: Ethernet autoselect (1000baseT <full-duplex>)
                                  	status: active
                                  	vlan: 102 vlanpcp: 0 parent interface: em0
                                  	groups: vlan
                                  	
                                  em0.103: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 mtu 1500
                                  	options=3<RXCSUM,TXCSUM>
                                  	ether 90:1b:0e:xx:xx:xx
                                  	inet6 fe80::xxxx:xxxx:xxxx:xxxx%em0.103 prefixlen 64 scopeid 0x9
                                  	inet xxx.xxx.xxx.47 netmask 0xfffffe00 broadcast xxx.xxx.xxx.255
                                  	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                  	media: Ethernet autoselect (1000baseT <full-duplex>)
                                  	status: active
                                  	vlan: 103 vlanpcp: 0 parent interface: em0
                                  	groups: vlan
                                  	
                                  em0.104: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 mtu 1500
                                  	options=3<RXCSUM,TXCSUM>
                                  	ether fe:b3:33:xx:xx:xx
                                  	inet6 fe80::xxxx:xxxx:xxxx:xxxx%em0.104 prefixlen 64 scopeid 0xa
                                  	inet xxx.xxx.xxx.240 netmask 0xffffff00 broadcast xxx.xxx.xxx.255
                                  	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                  	media: Ethernet autoselect (1000baseT <full-duplex>)
                                  	status: active
                                  	vlan: 104 vlanpcp: 0 parent interface: em0
                                  	groups: vlan
                                  	
                                  em0.105: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC> metric 0 mtu 1500
                                  	options=3<RXCSUM,TXCSUM>
                                  	ether e4:ee:1a:xx:xx:xx
                                  	inet6 fe80::xxxx:xxxx:xxxx:xxxx%em0.105 prefixlen 64 scopeid 0xb
                                  	inet xxx.xxx.xxx.230 netmask 0xfffffe00 broadcast xxx.xxx.xxx.255
                                  	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                  	media: Ethernet autoselect (1000baseT <full-duplex>)
                                  	status: active
                                  	vlan: 105 vlanpcp: 0 parent interface: em0
                                  	groups: vlan
                                  
                                  JKnottJ 1 Reply Last reply Reply Quote 0
                                  • JKnottJ
                                    JKnott @Wikai
                                    last edited by

                                    @Wikai

                                    First off, there's no need to hide the MAC address it's never seen beyond the local LAN. The only instance where you might be worried is when you use IPv6 and MAC based addresses. Other than that, it's irrelevant.

                                    Now, I've noticed some curious things.

                                    1. You have one (em0.10) that's 192.168.1.1. Why didn't it get a public address?
                                    2. em0 has no IPv4 address. Why not?
                                    3. The different VLANs have different subnet mask lengths and broadcast addresses. How is this possible with the same DHCP server?
                                    4. em0.103 & ,105, the broadcast address does not match the subnet mask.

                                    What happens if you ping those addresses from outside?

                                    PfSense running on Qotom mini PC
                                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                    UniFi AC-Lite access point

                                    I haven't lost my mind. It's around here...somewhere...

                                    W 1 Reply Last reply Reply Quote 0
                                    • W
                                      Wikai @JKnott
                                      last edited by Wikai

                                      @JKnott
                                      They're on the WAN side and visible to my ISP (except for em0.10), in other than that I agree ^^ The chances are slim. I know.

                                      1. em0.10 is my LAN vlan.
                                      2. It's just the way I set it up. em0.10 is my LAN vlan. They all get untagged in the switch anyway.
                                      3. Different DHCP servers and subnets. Ask my ISP... :-) I had to release/renew probably a hundred times in order to get each public IP on its separate subnet, in order for the gateway group/load balance to work.
                                      4. See 3. em0.103 & 105 netmasks are fffffe00, em0.102 ffffff80, em0.101 & 104 ffffff00.
                                      JKnottJ 1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott @Wikai
                                        last edited by

                                        @Wikai said in MAC address spoofing on VLAN's and impressions from a second-try user:

                                        Different DHCP servers and subnets. Ask my ISP... :-) I had to release/renew probably a hundred times in order to get each public IP on its separate subnet, in order for the gateway group/load balance to work.

                                        Then it's not stable. If you have a power failure, will you get the same when you boot up?

                                        See 3. em0.103 & 105 netmasks are fffffe00, em0.102 ffffff80, em0.101 & 104 ffffff00.

                                        You have fe.00 on some with broadcast .255 and others ff. If your broadcast is actually x.x.x.255, you mask must be ffffffffff00

                                        Fire up Packet Capture and filter on DHCP. Then disconnect/reconnect the WAN cable and see if you have different MACs for each VLAN. You'll want to download the capture, so that you can examine it with Wireshark.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        W 2 Replies Last reply Reply Quote 0
                                        • W
                                          Wikai @JKnott
                                          last edited by Wikai

                                          @JKnott

                                          Then it's not stable. If you have a power failure, will you get the same when you boot up?

                                          Yes. I've been running the same setup but on a multi-NIC machine for over a year with no issues.
                                          My ISP reserves the IPs for each MAC address for up to 24 hours I believe. The release/mac-spoof/renew was only for the initial setup.
                                          I carried the spoofed MAC addresses over to my new setup (the NUC) to make sure I didn't have to do it again.

                                          You have fe.00 on some with broadcast .255 and others ff. If your broadcast is actually x.x.x.255, you mask must be ffffffffff00

                                          IP xxx.xxx.7.47
                                          Gateway xxx.xxx.6.1
                                          Netmask 255.255.254.0
                                          Broadcast xxx.xxx.7.255

                                          Fire up Packet Capture and filter on DHCP. Then disconnect/reconnect the WAN cable and see if you have different MACs for each VLAN. You'll want to download the capture, so that you can examine it with Wireshark.

                                          Don't have the time right now. I'll reply again later.

                                          1 Reply Last reply Reply Quote 0
                                          • W
                                            Wikai @JKnott
                                            last edited by Wikai

                                            @JKnott
                                            Here's a montage of a packet capture on my WAN5 (em0.105) as i disconnect and reconnect the cable between the switch and single NIC.
                                            It seems I've misconfigured something as I'm able to see the DHCP requests of the other vlans on the packet capture of WAN5.
                                            It seems to be working fine, but this shouldn't be happening if the vlans truly were isolated, right?

                                            As you can see in frame 61 the spoofed vlan MAC shows up as source in the request and in frame 64 it's ACK'd.

                                            alt text

                                            Edit: Here's a pic of a speedtest on a site that supports measuring via web sockets. I'm supposed to only have 100/100 :-)
                                            alt text

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.