Is it possible to prevent client devices picking their own IP

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi,

I have multiple WAN uplinks with different IPs. Currently I set routing policies based on source IP, and use DHCP to serve static addresses by MAC or hostname.

I discovered a particular device was configured with an IP manually instead of DHCP, causing it to use the wrong WAN uplink. Is there a better way to do the configuration to prevent this?

Ideally I don't want to set VLANs because that would require multiple SSIDs which I fear would confuse some users, and they would select the wrong one.

I did see a mention of forcing IPs to MACs in the BanIP package documentation but that seems too heavy, my router (Redmi AC2100) only has 128mb RAM.

2

Yup, just use the standard "IP reservation" mechanism in LuCI. Go to Network -> DHCP and DNS and select the "Static Leases" tab. Click on that "Add" button and create a new reservation for the machine in question. You'll want to go to that machine and remove any self-assigned IP address, thus allowing OpenWrt to dictate the "static" IP for it.

3

That is how I currently manage the network, but in this case the client device had DHCP disabled and a manually set IP so it ignored the OpenWRT configuration

4

I want to prevent a machine from using an IP it did not recieve from OpenWRT via DHCP

5

Ah, got it. You have to do that on the client machine itself then. There's no way to force DHCP onto a host that is configure to ignore DHCP.

2 Likes
6

There's something similar in RouterOS https://forum.mikrotik.com/viewtopic.php?t=87889

If the interface's ARP mode is set to "reply-only" then the only way to get an ARP address into the ARP table is for the DHCP server to put it there (through "add ARP lease" setting in DHCP server). This means devices on network that did not get a DHCP lease will not get traffic routed to them, even if set up with a static IP address.

Not sure if OpenWRT has an equivalent but I'm sure it could be done.

7

Thank you I will look into this

8

The openNDS package has this functionality - if a device does not get its ip address from dhcp, it is denied access.

The downside is that all other devices are forced to login on the openNDS portal, unless they are listed by mac address as trusted.

Whether this compromise is worthwhile for you all depends upon how important it is for you to achieve your original aim.

1 Like
9

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.