DHCP Server Gateway setting not working
-
Hi Everyone,
I'm fairly new to pfSense, so please forgive any ignorance I might show with this question. : )
I have a single subnet network and am attempting to use the DHCP Server feature in pfSense to specify my transparent proxy server (separate machine from pfSense) as the default gateway for the network.
pfSense LAN interface is at 192.168.2.1
proxy interface on LAN is 192.168.2.8In Service -> DHCP Server, I specify 192.168.2.8 in the Gateway field, and restart the dhcp service, but clients still get 192.168.2.1 specified to them in the Router option of the DHCP offer from pfSense. I couldn't find any forum topics specifically related to this, so my apologies if it's been brought up before. Any help would be appreciated.
Thank you!
-
Eeeeeh? What are you doing? Why should a proxy be your default gateway?
-
Not sure why you would point anything to your proxy as a its default gateway.. But to pfsense to hand out the default gateway just put in the IP on dhcp server tabe its that easy.. Do you have something in the advanced dhcp options that conflict with that setting?
dhcp server will hand out gateway you put in there, or if left blank pfsense interface IP.. Your not putting something in that is not in the network of the dhcp server are you?
-
The proxy is a transparent one. The intention is to direct dhcp clients to it so that traffic can be decrypted/filtered/inspected by that appliance's rules, while still allowing static IP clients to specify pfSense's IP as their gateway (and to have filter rules to only allow certain IPs to connect to the internet that way). This setup works as I'm intending it to when I specify the proxy server's IP as the gateway statically. The problem is that despite the fact that I've specified the proxy's IP as the gateway in the DHCP server settings, the actual offer still specifies pfSense's LAN IP. Please see attached screenshot showing specified gateway and packet capture of DHCP offer. Also, I didn't explicitly say this or show it, but the machine does indeed end up with pfSense's LAN IP as its default gateway.
-
once you change the gateway to that IP, did you apply it and did your dhcp service actually restart?
edit:
Do you happen to have a reservation/static setup for that mac - this would hand out something different then what you have in the default config of the pool -
The proxy is a transparent one.
So why do you need to redirect GW there? Really what you are doing makes totally zero sense. Plus, when it's transparent it CANNOT be bypassed by the way you are suggesting.
-
once you change the gateway to that IP, did you apply it and did your dhcp service actually restart?
Yes, I both applied and manually restarted the service.
-
check my edit you sure you don't have a reservation or static for this mac.. That would hand out different info then your default configuration.
-
check my edit you sure you don't have a reservation or static for this mac.. That would hand out different info then your default configuration.
I have no static entries at all.
-
what version of pfsense are you running.. This is pretty straight forward stuff.. So either the config didn't load or didn't save?
You sure pfsense is the dhcp server your getting that from? Looks like a whole second before an offer goes out after the discover.. That seems really really long..
So in your sniff see offer at 5.34 and then offer at 6.35 that sure seems like really slow response.. Notice here in this transaction the time from discover to offer is ms..
edit
sure you don't have something the optional settings - if you put in say option 3 router in there it overwrites what you put in the gateway box in the gui. Just tested this put in .19 in the gateway and in the options put in 3 with .18 – got .18 no .19
-
Thanks for your continued attention to this question.
I checked the dhcpd.conf file, and it does look like it saved in there…
[2.2.3-RELEASE][root@firewall.localdomain]/var/dhcpd/etc: cat dhcpd.conf
option domain-name "localdomain";
option ldap-server code 95 = text;
option domain-search-list code 119 = text;
option arch code 93 = unsigned integer 16; # RFC4578default-lease-time 7200;
max-lease-time 86400;
log-facility local7;
one-lease-per-client true;
deny duplicates;
ping-check true;
update-conflict-detection false;
authoritative;
subnet 192.168.2.0 netmask 255.255.255.0 {
pool {
range 192.168.2.100 192.168.2.244;
}option routers 192.168.2.8;
option domain-name-servers 192.168.2.1;}
I agree that nearly a second seems like a long time, but that offer is indeed coming from pfsense. Here's the interface showing the mac that is making the same offer in that packet capture, (which I attached):
em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:2f:98:9c
inet6 fe80::20c:29ff:fe2f:989c%em0 prefixlen 64 scopeid 0x1
inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255
nd6 options=21 <performnud,auto_linklocal>media: Ethernet autoselect (1000baseT <full-duplex>)
status: active</full-duplex></performnud,auto_linklocal></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast> -
well clearly it seems to be in the config file.. You sure dhcpd reloaded and read the config?
I would reboot so your SURE that happened..
-
I would reboot so your SURE that happened..
That worked!
I suppose I was taking the 'unix' approach and assuming that a reboot would not be necessary. I did restart the service several times from the configurator, and it reported as successful, but maybe it wasn't actually restarting under the covers.
Thanks for your help and prompt replies!!
-
yeah I didn't have to reboot mine.. But clearly it was in the config - so if still handing out the old stuff then it didn't read the config for some reason.
Could of always killed the process, and then started it back up.. So curious now what is your response time from discover to offer..
