Multiple Issues with Full LAN Static ARP
-
I recently decided to enable static ARP, as I already have all of my devices connected with a static IP. Whenever I enable static ARP, about half of my devices cannot reconnect to the internet. I also have a Pihole device setup with Cloudflare DoH (HTTPS DNS), and I haven't found a way for that to reconnect either. Mutiple restarts, shutdowns -- nothing works, except of course disabling static ARP (which is an instant fix). Anyone have any experience with this?
Info on my setup. I have an Intel Quad Port NIC. 1 port for WAN, 1 for LAN, 1 for my wireless AP, and my Pihole uses the 4th port. Because I can't live without SMB, I bridge my WAP and LAN.
The reason I want to enable static ARP isn't for security purposes really, but to lock down certain devices with specific IPs which route traffic through a VPN on pfSense. And also mostly just because I'd like to see it work.
Any help would be nice.
-
Static ARP is completely unnecessary to locking down a device to an IP address. A DHCP static mapping is enough.
Employ basic troubleshooting techniques to determine why something you think should be working isn't.
Things like examining ARP tables, packet captures, etc.
-
Will have a go at it again eventually. I have a household worth of devices begging for the internet back, so it's a bit like working on a congested freeway. If that doesn't work, I think you're right about it being unnecessary. The way I have my rules setup already, it's like trying to apply a safety net to a safety net.
Just out of curiosity though (a second opinion), assuming a device assumes its static mapping under DHCP, and the DHCP server fails in pfSense -- is there any scenario in which data might leak through under a different LAN IP?
Don't expect much support on this, so thanks for the reply.
-
Not really. Unless the device has like a backup config. Windows has this type of setting.
Anyone can spoof whatever IP address or MAC address they want at any time. The firewall won't know the difference.
Your best bet, if it's actually important this works, is to set up different interfaces/VLANs for different security profiles.
-
@loopery said in Multiple Issues with Full LAN Static ARP:
I bridge my WAP and LAN.
And when you turn on this static arp - which devices fail? The ones that are wireless?
If you just plug your AP into your lan switch there is no reason to bridge.. But depending on how your AP is working you might not be seeing the actual mac of the client, but the mac of AP wired interface..
