[Solved in 2.1] Add only once static ARP Entry

nexus

Hi,

For an unknown reason my layer 2 switch don't respond to ARP requests for its admin interface. (works fine with a dd-wrt device on same subnet).

For the record pfsense - em0 - DHCP - 10.0.10.1/27 ===== Switch port 3 (pvid 10, Unttaged vlan 10) === port 7 (pvid 10, untagged vlan 10) === dd-wrt device.

The vlan 10 is said as management vlan in the switch configuration.

Netgear guys seems don't care about my issue, so I will try to fix it with help of pfsense.

The main idea is to set the arp entry as static for this ip address.

In the DHCP section, there is the option "Enable Static ARP Entries" which seems to work after adding a DHCP static mapping below.

The main question is regarding the Note : Only the machines listed below will be able to communicate with the firewall on this NIC.

I'm not sure to understand well why / and what it will happens if another device is connect to this subnet without a static DHCP mapping entry.

Is there another way to do that ?

Thanks for the Hint :)

johnpoz

So from my limited understand with pfsense/freebsd if you do the thing in dhcp your basically turning off arp resolution. This restricts traffic to only known macs

Now what it seems you want to be able to do is create a static entry that survives reboot because your having a hard time arping for that device. But you still want normal arp resolution to happen when devices on the network.

I don't think there is an option for that without doing some sort of script you run and load your macs you want into the table at boot.. I think in could normally do something like that in rc.config - but with pfsense doing its own thing on boot that might be a bit more complicated.

I think your best bet might be to just load the shellcmd package
http://doc.pfsense.org/index.php/Executing_commands_at_boot_time

and then put in whatever command(s) you need to create your arp entry.

arp -s hostname ether_addr [temp] [blackhole | reject] [pub [only]]
http://www.freebsd.org/cgi/man.cgi?query=arp&apropos=0&sektion=8&manpath=FreeBSD+8.3-RELEASE&arch=default&format=html

jimp

On 2.1 there is an option on the DHCP static mapping to do static ARP for just that entry, which will do what you need there.

nexus

Hmmm how mature the 2.1 is at the moment ? :p

OH RC I see :) I will give it a try. Can I update from nano 2.0.3 from the firmware menu (I mean will it crash all my settings :p).

Thnaks

johnpoz

I have been running 2.1 since it came out - and have not had any major issues with it.. But I only use it in a home setup, not production work setup.

nexus

Same here for home purpose (which looks like a personal datacenter now). I will take a shot with this release.

johnpoz

I run it via vm on esxi host.. When I went VM it really cleared up some space and lowered my electric vs having 4 different boxes running..

Nice about running it vm, is even if there is an issue with a snap or something - click and your back to snapshot you too before you upgraded.. That is if you took the snapsnot ;)

nexus

Works like a charm with 2.1 RC1, lots of good improvements btw thanks !