Updating MAC for a reserved IP problem

[johnpoz]

@pfpv said in Updating MAC for a reserved IP problem:

I read that some IP cameras start changing their MACs trying to call home.

Yeah I find that highly highly unlikely.. And would be pointless if you have your cameras on their own isolated vlan anyway, which would be best practice.. They could change their mac addresses all day long, or their ips.. not going to do them any good.

You know who does change their macs all the time - your freaking phone ;) You know protect your privacy ;)

[johnpoz]

@pfpv said in Updating MAC for a reserved IP problem:

I don't see any correlation why some would be expiring and some permanent.

there was a thread a while back - there is something not right with statics.. They change to dynamic or you see crazy long numbers for the expire time.. I do believe there is a redmine on it..

Thats why I had mine set as static, that was from when playing with it.. But look here 9.10 is still set to static but its currently showing as dynamic

then if I go into the reservation and hit save it goes to perm, but then expires, then perm.. And prob go to dynamic here after a while..

Let me see if I can dig up that redmine

There was a patch even at some point, but not sure if that fixed it, or then later there was a regression.. I would use static to be honest, and if you really need them, I would set them directly via arp command..

edit: here is the thread I was remembering
https://forum.netgate.com/topic/184155/static-arp-in-dhcp-overwritten

In that thread there is a link to a redmine, etc.

[pfpv]

@johnpoz said in Updating MAC for a reserved IP problem:

Yeah I find that highly highly unlikely.. And would be pointless if you have your cameras on their own isolated vlan anyway, which would be best practice.. They could change their mac addresses all day long, or their ips.. not going to do them any good.

https://ipcamtalk.com/threads/wifi-cameras-changing-mac-id.55347/
https://www.reddit.com/r/wyzecam/comments/gmvuc4/cameras_change_their_mac_addresses/
https://www.reddit.com/r/Ring/comments/z1uyq7/ring_stickup_elite_uses_random_mac_address/
And it doesn't seems to be intentional like in phones for "privacy". Some people think this was done in order to go around restrictions and phone home. Maybe one day I will move my cameras to a separate VLAN and block its access to the internet.

You know who does change their macs all the time - your freaking phone ;) You know protect your privacy ;)

Yes, all phones are set to use device MAC.

[pfpv]

@johnpoz said in Updating MAC for a reserved IP problem:

In that thread there is a link to a redmine, etc.

Thanks. I have a feeling that problem may have something to do with my struggle. The complaint is that static ARP entries become non-static but I think they continue to be static. If you reread my OP I tried everything when changing a NIC. I updated the MAC in the static mapping. I disabled static ARP, I deleted the ARP cache entry for the old NIC. I rebooted pfSense. The old MAC was nowhere in the system, yet the new card didn't get the old IP but the old one did.

The issue in that redmine never affected me. I didn't even know it was there. WOL always worked, devices were always getting the IPs they were mapped to.

I can only wait for 2.8.0 release. I moved from 23.09.1 to 2.7.2.

[johnpoz]

@pfpv said in Updating MAC for a reserved IP problem:

Some people think this was done in order to go around restrictions and phone home

And some people think the black helicopters hover outside their window at night as well ;) Don't mean they are ;) That 2nd thread looks like a specific issue with wyze.. And how they allocate the mac address to the device, etc.. It is not to get around "restrictions" ;)

Your 3rd link wouldn't load.

If your tinfoil hat is causing you to think that, then again put them on their own vlan and who cares what mac address they use, who cares if it changes every 2 hours, etc..

The whole concept of firerwall rules based on specific IP address and even mac filtering is on its way out.. With IPv6 and devices using temp addresses that they just pretty much just randomly create and change for outbound connections, even if you hand them a specific IP.. Makes specific firewall rules by IP pretty impossible to implement.. You also have all these devices that change macs, my phone does it (even though I have said to use devices mac) and my new apple watch has caused me grief sometimes when I notice some odd mac on my wifi network.. Trying to tack down a wifi device with an odd mac is hard, then I check my watch and its using private mac again, even though I told it not too... It think it reverts back on os update, etc.. I will check when the new watch os drops here pretty soon..

So with these sorts of shifts in tech, and how IPv6 is designed to work - your going to need to filter by network, vs allow this IP, but block that IP, etc.

Now segmenting your home network isn't just for fun any more ;)

[pfpv]

@johnpoz, thanks for the advice. I wasn't looking into the future (which is already now) with IPv6 like you did. And I will look into segmenting my network. For me MACs are still something hardcoded like it was a few years ago before phones started changing them and others followed. By the way, our Android phones never changed MACs once set to device MAC even after major updates. Sounds like Apple is being Apple.

Anyway, features related to static ARP and IP should work properly or should be removed from pfSense. In a few days I will do the dance of changing NICs again and will document better what will go on. I expect the same problems.

[johnpoz]

@pfpv said in Updating MAC for a reserved IP problem:

Sounds like Apple is being Apple.

Yeah - they just looking out for us you know ;) hehehe /s

features related to static ARP and IP should work properly

Completely agree.. there is something going on with it still.. That is clear.. I don't really have any need of them - so no horse in the race, or dog in the hunt if you will for me.. But yeah it should work..

If I did have need/want for it - I would prob just set the static with arp directly currently and not play around with the static arp in the dhcp stuff. But now that I think about.. There are really two places.. There is setting at the server setting to allow/enable them - and then there is the setting at the reservation.. I wonder if there is something going on related.. That if you don't have that set to use static arp everywhere that the setting on the specific reservation has problems?