Firewall receives IP from another network

ghekkolaner

I have a question about DHCP. My router (192.168.1.1/24 DHCP range 192.168.100-200) is connected to the netgate 6100 at port WAN 3 (Running on DHCP). There is a IP reservation for 192.168.1.100 for the firewall on the router.

Since about two weeks ago, I have had the problem that the firewall is assigned the IP 192.168.0.16 after a few hours.
When I perform an IP release and renew on the interface WAN 3, it gets the same IP (192.168.0.16) again. The problem is resolved when the router is restarted. Then the firewall receives 192.168.1.100 again and everything is working but only for a few hours.
I can confirm that the static IP reservation is not occupied by another device. There is only a TV box on this network (192.168.1.0/24) besides the firewall. I cannot understand where the IP 192.168.0.16 comes from.

What I tried (which didn't work):

Adjust static IP reservation to 192.168.1.200
A few hours later the WAN3 IP was again 192.168.0.16
Adjust IP range on the router to 192.168.2.1/24
A few hours later the WAN3 IP was again 192.168.0.16
Adjust IP range on the router to 192.168.0.1/24 with a reservation 192.168.0.16 for the firewall
After a few hours the firewall lost its internet connection
Static IP on WAN 3
I failed to set a static IP on interface 3. I didn't note down the exact error message, but it said something like “the IP range 192.168.1.0/24 is not assigned anywhere.”

When I restart the router and perform an IP release and renew, the firewall does not receive an IP address. Therefore, I assume that this IP address 192.168.0.16 is assigned by the router. Unfortunately, there are very few logs on the router and I haven't found anything suitable.
Is there any (DHCP) log to check where firwall gets this IP from?

ghekkolaner

When I try to set a static IPv4 on WAN3 Gateway I receive the following message:
The gateway address 192.168.1.1 does not lie within one of the chosen interface's subnets.

johnpoz

@ghekkolaner did you set the correct mask.. When setting static it defaults to a /32 - where yeah your going to get that error since any IP other than its own would be outside the range of a /32

If you are set to dhcp, and you get the wrong IP - this screams you have a different dhcp server on somewhere either the same L2 or something with a relay setup pointing to it.

If client set for dhcp, and the dhcp server is for 192.168.1.0/24 it doesn't just give itself a 192.168.0 - now if your scope is say a /23 on the dhcp - then sure you might see a different IP than you expect because a 192.168.1.0/23 would actually be 192.168.0.1-192.168.1.254

ghekkolaner

@johnpoz You're right! Thank you very much for this tip. I was able to successfully set the WAN3 IP statically and add the gateway with /24.

The router is in a /24 network. I cannot understand why I am getting 192.168.0.16. When the router restarts, no IP is assigned at all. I could imagine that the router has a problem, but I don't have another DHCP server. I was hoping that there would be a DHCP log where I could see which MAC address assigns the IP 192.168.0.16.
I will now monitor the problem over the next few days. Perhaps setting the static IP has solved it.

johnpoz

@ghekkolaner you could see what IP gave you the lease.

look in /var/db/dhclient.leases.interface

for example my wan is igb1

[25.07.1-RELEASE][admin@sg4860.home.arpa]/var/db: ls -la dhclient.leases.*
----------  1 root wheel 11267 Dec  5 17:20 dhclient.leases.igb1

If I look in that file I see the IP of the dhcp server

option dhcp-server-identifier 207.x.x.x;

You should then be able to look on this wan since its a private network and see the mac. I can not see the mac because that is from my isp and upstream inside the isp network on a different L2.

You also do a packet capture. Depending on how your network is setup.. Depending how your network is setup, sniffing on pfsense wan interface can be tricky sometimes with dhcp. My wan goes through a switch, where I could do a span port and see all traffic. But if your interface is going up down, might be hard to get the capture going on the actual interface. Capture would be ideal since it would show you exactly what was asked for and what was offered, etc.