Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Wrong assigned address

    Scheduled Pinned Locked Moved
    DHCP and DNS
    2
    12
    5.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fluca1978
      last edited by

      Hi,
      I've got a server with the lan interface connected to the 192.168.4.0 network, and the opt1 interface connected to the 192.168.44.0 network. Both interfaces have DHCP server enabled, and both the services have the right list of MAC addresses to which assing one or other address.
      Everything is fine except for a couple of windows clients that, even if their mac address is listed into the LAN map, are getting the OPT1 lease. In other words, clients mapped into the 4 network are getting addresses from the 44 one.
      I've tried to check the option "deny unknown hosts" on the service of the OPT1 interface, so to do not allow clients not listed in the mapping, but they are getting again the wrong network address. On the contrary, the LAN network does not have such option checked.
      What am I doing wrong?

      1 Reply Last reply Reply Quote 0
      • F
        fluca1978
        last edited by

        It's very strange, it seems as clients are requiring a lease first on the OPT1 interface than the LAN one. This could be correct, but how can I exclude unknown clients (i.e., not mapper MAC-IP ones) from getting a lease? I've checked the "Deny unknown clients" from the OPT1 DHCP server options, but it does not work, and I cannot specify that the range for the DHCP on OPT1 should be null (i.e., only registered clients can get a lease).
        Any suggestion?

        1 Reply Last reply Reply Quote 0
        • F
          fluca1978
          last edited by

          I found in the logs something that could help understanding what is going wrong:

          kernel: arp: 192.168.44.180 is on rl0 but got reply from 00:17:f2:07:68:1b on nfe0

          rl0 is the network card attached to the 192.168.44.0 network, while nfe0 is the one 192.168.4.0 network. The message says that, even if the address is registered (mapped) on the network 192.168.44.0 the interface of the other network is going to reply to the DHCP request.
          Is there something I can do about this?

          1 Reply Last reply Reply Quote 0
          • GruensFroeschliG
            GruensFroeschli
            last edited by

            Did you plug two NICs into the same switch?
            If yes and you're actually running 2 DHCP servers on the same broadcast domain, you're just asking for trouble.
            Get another switch and separate your subnets.

            We do what we must, because we can.

            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

            1 Reply Last reply Reply Quote 0
            • F
              fluca1978
              last edited by

              Ops…yeah I realized it after I post the message: wrong vlan configuration. Now it seems to work having separated well the switch ports.

              1 Reply Last reply Reply Quote 0
              • GruensFroeschliG
                GruensFroeschli
                last edited by

                If you're using a VLAN switch you could create a trunk to the pfSense and create tagged virtual interfaces on the pfSense.
                Like this you could make sure that the traffic going to the switch certainly lands in the correct VLAN.

                We do what we must, because we can.

                Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                1 Reply Last reply Reply Quote 0
                • F
                  fluca1978
                  last edited by

                  @GruensFroeschli:

                  If you're using a VLAN switch you could create a trunk to the pfSense and create tagged virtual interfaces on the pfSense.

                  Sorry,it is not clear to me what the benefits of this could be. Can you explain me better or point to some documentation about?

                  1 Reply Last reply Reply Quote 0
                  • GruensFroeschliG
                    GruensFroeschli
                    last edited by

                    The benefit is, that you need only one physical interface for as many interfaces as you need.
                    you create as many VLANs as you need on this parent interface.
                    Each VLAN apears on the pfSense as if it were a real interface.
                    You then have only one cable to the switch.
                    The VLAN configuration on the switch takes care that each VLAN interface can communicate only with the member ports of the same VLAN.

                    IMO its just clearer to only have one trunk to the pfSense and separate traffic via configuration, than putting many NICs and connect multiple cables.

                    I'll have to search the forum for documentation/howtos.
                    (writing currently from iPhone).

                    We do what we must, because we can.

                    Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                    1 Reply Last reply Reply Quote 0
                    • F
                      fluca1978
                      last edited by

                      But using one interface on the firewall will physically limit the bandwith for both the VLANs, while having it managed thru the switch plus two NICs will have a better backplane speed, isn't it? So I believe if possible the solution with a separate NIC for each network will give better performance.

                      1 Reply Last reply Reply Quote 0
                      • GruensFroeschliG
                        GruensFroeschli
                        last edited by

                        Depends.
                        When i have such a setup i usually use a Netgear FS726T.
                        They have 2 Gbit port and 24 10/100 Mbit ports.
                        Using a Gbit port to the pfSense leaves much bandwidth free for additional VLANs.
                        But yes if you're just connecting a single 100 Mbit port you will probably be better off with 2 interfaces.

                        We do what we must, because we can.

                        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                        1 Reply Last reply Reply Quote 0
                        • F
                          fluca1978
                          last edited by

                          Having difficulties to get the two networks working (see http://forum.pfsense.org/index.php/topic,24454.0.html), could it be better to get pfsense manage vlans on a single nic instead of two nics? I have a switch with a gigabit port to use for the pfsense network card. In the case I use pfsense to manage the vlans should I have the switch to work in tagged or untagged mode?

                          1 Reply Last reply Reply Quote 0
                          • GruensFroeschliG
                            GruensFroeschli
                            last edited by

                            When working with VLANs:

                            • If you assign a VLAN on a parent interface, DON'T assign the interface itself.
                              (ie: vlan100 on rl0, vlan200 on rl0, vlan300 on rl0, rl0 itself NOT assigned).

                            • Traffic leaving the pfSense is always tagged.
                              The switch should be apropriatly configured
                              –>accept only tagged traffic from the port going to the pfSense. Drop/block untagged traffic.
                              Traffic going to the pfSense should be tagged as well.
                              We dont assign the parent interface itself so untagged traffic will be dropped on the pfSense side too.

                            I dont see any problem with having VLANs on different parent interfaces.

                            We do what we must, because we can.

                            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post