Devices Not Getting IP from pfSense DHCP Through TP-Link AX95 Router

spearhavoc

Re: Devices Not Getting IP from pfSense DHCP Through TP-Link AX1500 Router

Greetings,

I have a Net Gate 3100 running pfSense acting as my boundary device and as the DHCP server for my wired devices. The Net Gate LAN interface is 192.168.1.1, and it provides IP addressed in 192.168.1.0/24, for which it is also the default router. Most of my devices have static IP reservations.

The ports of the Net Gate are used thus:

LAN01: Cisco Catalyst 24 port PoE switch
LAN02: NetGear G724T, 24 port, 1Gbps ,no PoE switch
LAN03: Not in use
LAN04: TP-Link Archer AX95 WiFi Router (WAN interface)
OPT1: Not in Use
WAN: Uplink to ISP cable modem

The AX95 is part of a OneMesh configuration that includes itself and three range extenders. OneMesh will only work if the AX95 is in Wireless Router Mode. Other than basic wireless conectivity for my wireless devices, OneMesh is the only capability of the AX95 in which I have any interest.

The WAN interface of the AX95 is connected to the LAN04 port on the Net Gate, and is assigned 192.168.1.10. The LAN interface of the AX95 presents as 192.168.86.1 and it is the DHCP server for all the wireless devices, providing IP addresses in 192.168.86.0/24, for which it is also the default router.

I want a Home Assistant (192.168.1.99) that is connected to the switch on LAN01 to be able to autodetect some wifi automation devices that connect wirelessly to the AX95. The detection mechanism is by UDP broadcast (255.255.255.255:6666). Obviously, by default, the AX95 blocks broadcasts that originate in what it sees as the "WAN". Here is where my problems begin.

UDP broadcasts from the Home Assistant are seen by wired devices connected via LAN01 or LAN02; they are not seen by any devices behind the AX95. However, directed UDP datagrams are seen, for example to 192.168.86.105:6666.

I started by disabling the firewall function of the AX95. Didn't help.

At this point I tried to implement what @vitorlm describes in the post referenced in the subject: having all devices in a single subnet, and providing IP addresses only from pfSense.

I assigned new IP reservations in 192.168.1.0/24 in pfSense for the wireless devices. I then just turned off the DHCP service on the AX95. After this the wireless devices were unable to connect to the WLAN; they reported being unable to obtain an IP address.

My next idea was to remove 192.168.86.0/24 altogether. To do this I assigned the LAN interface of the AX95 the address 192.168.1.11/24 and left the DHCP server and the firewall in the AX95 disabled and additionally disabled NAT on the AX95. Still no IP addresses for the wireless devices.

This is where things sit right now.

My next step will be to completely readdress 192.168.1.0/24 to carve out a block exclusively for wireless devices, that can be managed by the DHCP server on the AX95. This will not be a small task and frankly, I have only slight expectation of its success in achieving my goal.

So, before I do this, I'm wondering if anyone would have any insight or suggestions regarding what might be preventing the devices connected to the AX95 from receiving their IPs from pfSense. Perhaps there are specific settings or configurations on the AX95 or pfSense that I might have overlooked?

I am almost certain that I could resolve this problem by running the AX96 in Access Point mode. However, in AccessPoint mode I would lose OneMesh and the three range extenders and so impair wireless coverage in parts of my basement and a couple of bedrooms.

Also, for the record, I have been in converstion with TP-Link's support team, who have been friendly and helpful, but as yet unable to address the specific problem.

Any new ideas would be most welcome.

Thanks.

Gertjan

@spearhavoc said in Devices Not Getting IP from pfSense DHCP Through TP-Link AX95 Router:

LAN04: TP-Link Archer AX95 WiFi Router (WAN interface)

That's a router behind a router (pfSense) situation.
Normally, you don't do that
All devices connected to this "TP-Link Archer AX95 WiFi Router", on its LAN (or Wifi) will use the DHCP server of this TP-Link Archer AX95 WiFi Router - and not pfSense.

Normally, you would use the WAN interface of this "TP-Link Archer AX95 WiFi Router" to connect it direly to the "Uplink to ISP cable modem" device.

If possible, set up the "TP-Link Archer AX95 WiFi Router" as a AP, don't use it as a router.
And then connect the "TP-Link Archer AX95 WiFi Router" to pfSense with one if it's ("TP-Link Archer AX95 WiFi Router") LAN ports, don't use the WAN port anymore.
Disable the DHCP server on the "TP-Link Archer AX95 WiFi Router".
Disable DNS.
Firewall probably not needed anymore - the "TP-Link Archer AX95 WiFi Router" will now be an AP ith a build in switch.
Give it a static IP like 192.168.1.2 - gateway 192.168.1.1 (pfSense LAN) and DNS 192.168.1.1 (pfSense LAN) and done ^^

spearhavoc

@Gertjan said in Devices Not Getting IP from pfSense DHCP Through TP-Link AX95 Router:

That's a router behind a router (pfSense) situation.
Normally, you don't do that

Indeed so, and certainly not something I'd do by choice. I am only using the AX95 in Router mode because OneMesh does not work when it's in AP mode.

I had not previously considered your suggestion to use one of the AX95 LAN ports for the uplink to the pfSense. I will give it a go.

Thanks for the suggestion.

spearhavoc

@Gertjan said in Devices Not Getting IP from pfSense DHCP Through TP-Link AX95 Router:

connect the "TP-Link Archer AX95 WiFi Router" to pfSense with one if it's ("TP-Link Archer AX95 WiFi Router") LAN ports, don't use the WAN port anymore.
Disable the DHCP server on the "TP-Link Archer AX95 WiFi Router".
Disable DNS.

I have followed your suggestion. It mostly seems to work. devices appear to be able to get access from the range extenders.

It does really seem to screw up the ability of the AX95 to report on its clients though. Now I can see only between 5 and 12 connected wifi devices when there are 30-35 at any one time. Also, I cannot tell any longer which of them are connected to the Guest network as opposed to the main network.

However, all my devices are now in a single broadcast domain, and OneMesh seems to still be working. these were my goals, so, thank you. :-)

Michael.
@vitorlm