I have a DHCP Server set up on a RouterBoard, RouterOS, interface wlan2. On that interface, it appears that somebody (I know the node) is publishing a DHCP Server as well.
Some of the nodes on wlan2 get a response from the rogue DHCP Server instead of the RouterOS Server.
How can I configure RouterOS to not allow the rogue to communicate to the other nodes? Since they are in the same subnet, how can I filter this?
I have had this happen to me. Customers possibly could rewire their internet connection and put the WAN connection into a LAN port on their routers (this is what happened), or a customer possibly could have a server hosted on the Internet connection and mistakenly enable DHCP on the WAN side. I am no guru on Mikrotik OS, but I was able to solve the problem using a brute force method. If you know the node, and I would assume then you know the MAC of the node, I would proceed as follows: 1) Positively identify their IP and MAC. In the IP section of Winbox and go to ARP. 2)Find their ARP entry. 3) There are two paths depending on how they obtain their IP address. If they are static, then the ARP entry can be just disabled. Essentially you are using a burned in address for the MAC, and have blackholed it. If they obtain address thru your DHCP server, find their address, and make it static (MAC reservation). Then disable the lease for that IP/MAC combination. This should prompt a call from them, and you can begin the discussion. Also, in the DHCP Server menu, there is a tab called Alerts. It refers to ‘Unknown’ DHCP servers. I am not sure if it stops them, or just alerts you to their existence. I think the first method is sure to work because it solved my problem, and I saw the miswired connections myself.
Hope this helps. Correct me if I am wrong…
Make sure “forwarding” is turned of on that interface, or your customers will continue talking directly to each other through the radio and any filtering you try to do in the router won’t be very effective. You can then put firewall rules in the forwarding table of the router that block the DHCP ports, you’ll want to block requests going out wlan2 and responses coming in from there.
And since this is your network infrastructure that one customer is screwing with, I’d disable his account until he calls in and talks to you, and then onfirms he’s found his misconfiguration and corrected it.