Serious issue with ARP

RouterOS General
21

vs
jul/26/2021 0: 3:54 by RouterOS 6.48.1 ?

Are these the same device? One of the switches? You provide no info.

I think its time to give us a diagram of your network. You never said anything about the other router (the ISP triple play box) until now.

Even a photo of a hand drawn sketch would be a lot better than the nothing you have provided.

We can't provide useful info without you first providing useful info.

So it has no wifi built in?

How did you determine that "those IPs are not visible on it" ? What exactly did you look at?

Time for you to answer the questions here Please follow the standard litany when giving a problem report.

Also see How to Report Bugs Effectively

22

I've attempted to review your configuration in case I can add something helpful. Generally, ARP is almost never the problem, but connectivity issued can be traced back to something else, and when that is fixed, the ARP entries get corrected on their own. I think your focus on ARP is misplaced.

There are a number of strange things in your configuration.

  • Others have mentioned it, but if you don't use vlan filtering, then don't use vlans
  • You have rtsp enabled with protocol-mode=short - do you really want/need rstp, and if so, do you really want short headers?
  • You have igmp snooping enabled - I guess because of the TV, but do you really need it? Can it be turned off just for debugging?
  • You have use-ip-firewall turned on for you bridge both for normal traffic and vlans. What is the purpose of this? This is a really strange setup. Especially with IGMP snooping.
  • Your firewall setup is really strange. Besides using raw/prerouting inconsistently, the rules you have should generally be in the filter (input and forward) chains, and they are totally disorganized/haphazard.
  • The DHCP servers are configured with add-static-arp, which is not what you would actually want in this setup (and this is one of the things that "pollute" your arp table), and also always-broadcast - both of these settings are non-default and are only needed for setups that are somehow special

It seems like you haven't decided whether this device should be a router, a router + switch, an ip-filtered bridge (this is what the use-ip-firewall would hint at) - so how it fits into the topology of your network.

All this, with your device basically having no meaningful configuration beyond being a switch/bridge for your network and a DHCP server with some firewall tules thrown in.

I would suggest redoing your configuration from scratch, carefully considering and adding functionality as you go along. Of course I would also suggest saving your current configuration both as text (export) and binary (backup). This allows you to cut-and-paste your extensive static dhcp configuration without the (no doubt significant) manual labor involved.

23

Thanks for your comments. I have performed the fixes you've proposed. I've cleaned firewall rules (a bit) but not sure I understand your points about the ones in the RAW/prerouting list.
I rebooted the router which fortunately cleaned the dual IP address for 192.168.0.175 in the arp table. I also added the 2 following rules to avoid the 192.168.1.x arp entries:
/ip firewall filter
add chain=forward action=drop dst-address=192.168.0.0/16 in-interface-list=LAN out-interface=sfp-sfpplus1-WAN-FTTH
comment="Drop LAN -> RFC1918 on WAN"
add chain=output action=drop dst-address=192.168.0.0/16 out-interface=sfp-sfpplus1-WAN-FTTH
comment="Drop router itself -> RFC1918 on WAN"
It looks ok now.
Now I'm moving to a new 2216 instead of the 1036 and I'd like to properly introduce multiple VLANs to segment the LAN in a more consistent manner... long nights to come :slight_smile: