DHCP issuing wrong ip's for wrong VLANs

firedemon

I have an issue where i have 3 vlans setup with dhcp scopes in pfsense, which are being issued via dhcp relay on 2 unifi switches to 2 unifi APs.

I am confused by the dhcp logs and as to why this started happening.
I also have the unifi switches alerting me to a rogue DHCP server which cites the MAC of my pfsense box.

Any suggestions on where to look or guidance ?

firedemon

VLAN 2 - 172.17.2.x - SECURE wireless
VLAN 5 - 172.17.5.x - IOT wireless
VLAN 4 - 172.17.4.x - KIDS wireless

i can connect to SECURE wireless & be given 172.17.5.x IP and then the VLAN 2 rules apply to my 5.x IP and does not resolve properly since i am only allowing 2.1 as the DNS server, but vlan 5 dns issues its settings 1.1.1.1 & 9.9.9.9 (which are blocked on vlan 2 since i have it set to only allow 2.1 as the dns server).
Same goes with different networks and wrong dhcp scopes being assigned.

This happened out of the blue.
vlans are segmented, dhcp scopes are different, networks are in unifi controller, traffic is tagged, dhcp relay is set

Possible causes:
-I have a SPAN port setup with a bridge interface mirroring traffic to another box analyzing traffic.
-Suricata randomly disappeared until i reinstalled it
-i turned off pfBlockerNG-dev temporarily to try to upgrade my unifi products (AP's will not upgrade successfully)
-i have since forgotten 1 switch and 1 AP as the AP wouldnt upgrade and the switch stopped being seen
-i am getting a rogue dhcp server message from the switches pointing to the MAC of my pfSense box

NogBadTheBad

Do a packet capture on pfsense and have a look at the dhcp packets in and out each vlan interface.

Think its an issue with the switch setup.

I have pfBlockerNG-dev running and I can upgrade my Unifi AP fine.

johnpoz

@firedemon said in DHCP issuing wrong ip's for wrong VLANs:

which are being issued via dhcp relay on 2 unifi switches to 2 unifi APs.

Huh?? Pfsense can not be the destination for a dhcp relay, it has to have an interface in the L2 its assigning dhcp to.. So why would need or have relays setup?

How about a drawing - so we can help you figure out what is going on. What is actually handing out the dhcp?

If clients are in the L2 that dhcp server is attached to, there would be no relays needed to be setup anywhere. You only need a relay for an L2 that that is not attached to the dhcp server, and this dhcp server has scopes for these unattached vlans.. You can not do this with pfsense, where pfsense is the dest of relay you setup... It can be a relay, but then it can not run dhcpd on that vlan.

firedemon

The issue was the bridge I setup when trying to get my segmented VLANs mirrored to a SPAN port.
I deleted the bridge as I had all VLANs as members of 1 bridge.
Everything works as expected with DHCP assigning the proper scopes to the appropriate networks.

Regarding the SPAN port...

Can I setup 1 vlan per bridge to the span port to accomplish this? (Ie. 1 bridge = Lan vlan -> Span , another bridge = IOT vlan -> span, another bridge = kids vlan -> span)
Do I include the WAN port to the span port?
Is a span port on a switch a better option & where is the ideal placement for this switch to monitor all traffic going in and out across all vlans?

johnpoz

@firedemon said in DHCP issuing wrong ip's for wrong VLANs:

I deleted the bridge as I had all VLANs as members of 1 bridge.

Huh.. Yeah that is Borked for sure!!

Yeah do your span on your switch.. Grab whatever vlans you want.