• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Multiple Issues with Full LAN Static ARP

Scheduled Pinned Locked Moved DHCP and DNS
5 Posts 3 Posters 561 Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • L
    loopery
    last edited by May 17, 2019, 5:07 AM

    I recently decided to enable static ARP, as I already have all of my devices connected with a static IP. Whenever I enable static ARP, about half of my devices cannot reconnect to the internet. I also have a Pihole device setup with Cloudflare DoH (HTTPS DNS), and I haven't found a way for that to reconnect either. Mutiple restarts, shutdowns -- nothing works, except of course disabling static ARP (which is an instant fix). Anyone have any experience with this?

    Info on my setup. I have an Intel Quad Port NIC. 1 port for WAN, 1 for LAN, 1 for my wireless AP, and my Pihole uses the 4th port. Because I can't live without SMB, I bridge my WAP and LAN.

    The reason I want to enable static ARP isn't for security purposes really, but to lock down certain devices with specific IPs which route traffic through a VPN on pfSense. And also mostly just because I'd like to see it work.

    Any help would be nice.

    1 Reply Last reply Reply Quote 0
    • D
      Derelict LAYER 8 Netgate
      last edited by May 17, 2019, 9:20 AM

      Static ARP is completely unnecessary to locking down a device to an IP address. A DHCP static mapping is enough.

      Employ basic troubleshooting techniques to determine why something you think should be working isn't.

      Things like examining ARP tables, packet captures, etc.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      L 1 Reply Last reply May 17, 2019, 9:40 AM Reply Quote 0
      • L
        loopery @Derelict
        last edited by May 17, 2019, 9:40 AM

        @Derelict

        Will have a go at it again eventually. I have a household worth of devices begging for the internet back, so it's a bit like working on a congested freeway. If that doesn't work, I think you're right about it being unnecessary. The way I have my rules setup already, it's like trying to apply a safety net to a safety net.

        Just out of curiosity though (a second opinion), assuming a device assumes its static mapping under DHCP, and the DHCP server fails in pfSense -- is there any scenario in which data might leak through under a different LAN IP?

        Don't expect much support on this, so thanks for the reply.

        1 Reply Last reply Reply Quote 0
        • D
          Derelict LAYER 8 Netgate
          last edited by May 17, 2019, 9:44 AM

          Not really. Unless the device has like a backup config. Windows has this type of setting.

          Anyone can spoof whatever IP address or MAC address they want at any time. The firewall won't know the difference.

          Your best bet, if it's actually important this works, is to set up different interfaces/VLANs for different security profiles.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator
            last edited by May 17, 2019, 11:00 AM

            @loopery said in Multiple Issues with Full LAN Static ARP:

            I bridge my WAP and LAN.

            And when you turn on this static arp - which devices fail? The ones that are wireless?

            If you just plug your AP into your lan switch there is no reason to bridge.. But depending on how your AP is working you might not be seeing the actual mac of the client, but the mac of AP wired interface..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            2 out of 5
            • First post
              2/5
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
              This community forum collects and processes your personal information.
              consent.not_received