Getting rogue DHCP settings on some LAN clients

[steenbras]

Hi,

I've got a setup where there are 2 potential WWW routes on the LAN. One is via pfSense, to the DSL router. The other is via another LAN client, to a 3G terminal. The intention is that all LAN clients negotiating DHCP get handed the pfSense machine as gateway/DNS server etc, except for one machine which we use for videoconferencing, which is manually configured to take the IP of the client connected to the 3G terminal.

Therefore the desired setup is like this

Default LAN client –-> switch ---> pfSense ---> DSL ---> WWW
Videoconferencing client ---> switch ---> 3G client---> ---> 3G terminal --> WWW

The switch does no DHCP, nor does any wireless access point, so as far as I can ascertain pfSense is the only DHCP server. The problem I encounter is that some LAN clients, and the victims appear to be random, get assigned the 3G client as the default gateway and/or DNS server. But pfSense should be allocating its host machine as both.

Any ideas why this is happening?

Thanks

[steenbras]

I'm thouroughly confused here. I have no idea how this is happening. I can see the whole handshake in the DHCP logs, but for some reason the client still picks up this other gateway.

The DHCP settings in pfSense are the default ones. I tried specifying a gateway on the page, and specified the LAN IP of the pfSense box. That had no effect. I've reversed this change, so that the gateway field is now blank.

Please - would appreciate any help from gurus. This is extremely bizarre.

Thanks

[steenbras]

Right - I disabled UPnP on the XP machine which is the wrong gateway, and now it appears that the correct way is being assigned to all clients. But as this appeared to be a fairly random thing, I'm not 100% sure that the problem has gone away. Can anyone let me know if this would solve the issue please?

[GruensFroeschli]

Upnp is not related to DHCP.
It's only used to forward/open ports.

From how i read it, it seems you have a DHCP-server running on the 3G client.
Or did you at one point let the 3G client act as DHCP server and then disabled it?

[steenbras]

Well, unsurprisingly, the problem has not gone away.  ??? Occasional clients are still getting the rogue gateway.

There has never (intentionally) been a DHCP server running on the 3G client. This client is a Windows XP Pro machine, and looking in the control panel the only DHCP service I could see was a DHCP Client service which appears to run on XP by default.

Also, as I mentioned earlier I could see the DHCP handshake - request, inform, ack, etc in the pfSense DHCP logs, showing the IP the client received, but then an ipconfig /all on the windows client (not the 3G one - just another client on the network) showed the DHCP negotiated IP from pfSense, but the gateway IP is the one of the 3G client.