recently I updated from my simple ISP Router to mikrotik. I have a hex s handling all routing and a cap ax to do wifi. The cap ax is managed over hex s. I have a generic DHCP server with tons of static IPs in which all works fine. Windows laptops, no issue over wifi, LAN all is static as I setup. However I just cannot get my iphone a static IP
There is this fancy feature in the iphone wifi setting "Private Wifi Address" It can be OFF/Fixed/Rotating.
I thought if I use Fixed, it will stay with 1 single MAC to the wifi network, therefore I can assign static IP. I tried to Make Static, I tried only client ID (seen in google as hint) only MAC, both MAC + client ID... and it does not work.. I get my wished IP, then sooner or later the iphone swaps the MAC and I loose my static IP. As of now it only works if I use Private Wifi Address = OFF.
Is it really how it should? Did anybody see such thing or experienced especially with iphones?
Do you have any idea how can I make my iphone static in this simple setup?
When "Fixed", the iPhone, under ordinary use, should not change its MAC address by design.
However, this sometimes happens after iOS updates, after waking from sleep, or for other unexplained reasons. This behavior is observed on various iPhone and Apple Watch models.
There is only one correct solution to the problem, which you have found yourself -"As of now it only works if I use Private Wifi Address = OFF."
If I remember correctly (and it’s been quite awhile since I explored this, so things may have changed), “Fixed” would change the MAC address whenever you hop between different BSSIDs of same ESSID.
It essentially assumes that if the BSSID has changed, treat current ESSID as if it is a new network, although it preserves the settings as was set per the user for said ESSID.
Things could and more than likely did change since than, but I personally reversed engineered both the WiFi firmware as well as the kernel side implementation around the time Apple introduced this feature.
Although this wasn’t one of my research goals, I do remember seeing implicit conditionals for MAC address randomization based on BSSIDs.
Thanks for the answer! I found some forums here on this topic, but some was dated years back and I thought we have a fix so far, but seems to be not.
I tested so far a week, my macbook with Private Wifi Address = Fixed --> can work and I am always landing in the static range and not in the dynamic dhcp pool.
However with ipads, iphones at home this is not the case. I read exactly similar things this "wake up from deep sleep" but I am not an expert on the field so for me = OFF is enough. It is my private home LAN, so if 95% of the stuff not bothered to use the same MAC what they were shipped out from the factory, then I am not really bothered on my iphones as well
It is time that this whole "private MAC" circus is abandoned and devices go back to using their registered MAC.
Originally it was implemented "to prevent tracking", and it used a separate random MAC for each access point it connects to. However, that caused serious issues: e.g. at work we have a big building with 40 access points all bridged together for a single guest network, and people walking around would be using a different MAC wherever they went, and the DHCP pool was quickly depleted. Also they lost their IP connections every time they roamed to another AP, not good when you are e.g. using VoIP or VoWIFI.
However, Apple (and Microsoft) quickly "fixed" that by using the same generated random MAC when connecting to the same SSID. Unfortunately, THAT DEFEATS THE ENTIRE PURPOSE OF THIS. The people who they fear are tracking you (like chain shops and restaurants) use the same SSID in every location, and they still get your random MAC to track you! The purpose was entirely defeated.
Microsoft understood that, and backed out of this whole thing. I.e. it is still possible, but it is disabled by default. Apple and Android still have it enabled by default.
Just turn it off. It serves no purpose at all, and only causes problems and confusion.
I would not have any problem at all if the "Fixed" is working... so far according to my tests the macbook uses fixed, never missed a DHCP static request... the bloody iphones however are crazy so for me right now as I understood there is no good solution here I turned this feature off in all my modern Apple devices (even for damm watches).
Reading your comment on this with history, this is now really sounds ridiculous:) and I understand now why MS turned this off default, and let the advance users use it if they can set it up.
On a project I have dozens of iPAD's for restaurant orderings etc.
By default = DISABLED/OFF this Private setting and it uses the system MAC address of the Wifi so at lease it becomes predictable again.
I assign fixed IP's through DHCP based on their MAC and firewall-rules are in place.
Non of this is on Mikrotik (Cisco/Palo Alto), but the concept is the same everywhere
I am using 1 security profile which is WPA2 PSK and WPA3 PSK with CCMP and GCMP. I have 2,4ghz and 5ghz in provison. For wifi config, i am using 2 configs one for 2,4ghz and one for 5 ghz. The config differs on fixed channel and frequency setup. For 2,4ghz i am positioning myself in ISM channel 6, while 5ghz is under UNII-1 to avoid this radar scanning territory All of this I kind of learned from a Mikrotik master video in youtube, since I am abs. new with this brand, the video and the deep setup for me looked OK
btw i know this sounds like offtopic, but seems to be that you are kind of an expert on this... Do you recommend any better Auth.type + Encryption ciphers or what I use are up-to-date? It was a long time that I set some wifi rules (really kind of a decade ago) and I have no clue what is todays best for generic protection at home.
I am not going to touch anything on VLAN (i am planning to set that up later) and also I read/view somewhere this multi passphrase group, that's i am planning for guests (kids/wife friends etc...)
so for me right now as I understood there is no good solution here I turned this feature off in all my modern Apple devices (even for damm watches).