Community discussions

 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Impossible to block DHCP Server. By design, or bug???

Fri Oct 23, 2009 4:46 pm

No matter what rules I use, I can not block the Mikrotik DHCP Server on UDP 67 from any interfaces. I have deny udp 66-67 on both input and forward chain. That *should* block it from everything, but it has no effect. I have seen a few other posts with this same question.

I have a bridge over L2TP between Mikrotik 3.30 routers, but each end uses its own DHCP, which should not be shared because then one end would be using the gateway of the other end... and they both need internet access even if the other end is down. I have turned on "Use IP Firewall" in the bridge settings.

Please don't make this a discussion about whether or not I should want to block DHCP, or why it needs to be done, or that routing would work better, or any other workarounds.

I am simply wanting to know whether this is by design, that the DHCP Server comes before the firewall... or is this a bug?
 
User avatar
Ibersystems
Forum Guru
Forum Guru
Posts: 1683
Joined: Wed Apr 12, 2006 12:29 am
Location: Cabrils, Barcelona - Spain
Contact:

Re: Impossible to block DHCP Server. By design, or bug???

Fri Oct 23, 2009 8:22 pm

Hi,

you configured the filter in bridge/filter? or in ip/firewall filter?
Martín
martinruiz at ibersystems.es
Experto en redes WiFi y enlaces WiFi.

Facebook: @Ibersystems
Twitter: @Ibersystems

Certified in Traffic Shaping, Wireless, Internetworking, Routing and User Management.
MTCTCE - MTCWE - MTCINE - MTCUME - MTCRE
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Fri Oct 23, 2009 9:29 pm

It is configured in IP Firewall.

I *think* (but not 100% certain) that even without a bridge involved, the rules still do nothing.
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8308
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Impossible to block DHCP Server. By design, or bug???

Fri Oct 23, 2009 11:57 pm

I have deny udp 66-67 on both input and forward chain
btw, DHCP is ports 67-68...
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Sat Oct 24, 2009 12:02 am

You are right. I was actually using the correct 67-68 in the rules, the 66 is just a typo on my post.


I have deny udp 66-67 on both input and forward chain
btw, DHCP is ports 67-68...
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8308
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Impossible to block DHCP Server. By design, or bug???

Sat Oct 24, 2009 12:10 am

do you have /interface bridge settings set use-ip-firewall=yes ?
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Sat Oct 24, 2009 12:21 am

yes, on both sides. also, this is interesting... as i send dhcp requests, i can see the packets on the drop rule increasing, but i always receive a dhcp response, and torch shows it using 67.
 
fewi
Forum Guru
Forum Guru
Posts: 7734
Joined: Tue Aug 11, 2009 3:19 am

Re: Impossible to block DHCP Server. By design, or bug???

Sat Oct 24, 2009 12:26 am

Looks like I can reproduce this on 4.1. Not on a bridge, but just on a standard network behind an interface, with standard DHCP server setup.

Cover all chains and drop UDP 67 and 68:
[admin@Mikrotik] > /ip firewall filter print det  
Flags: X - disabled, I - invalid, D - dynamic 
 0   chain=input action=drop protocol=udp dst-port=67,68
 1   chain=forward action=drop protocol=udp dst-port=67,68 
 2   chain=output action=drop protocol=udp dst-port=67,68
Counters are clear:
[admin@Mikrotik] > /ip firewall filter pri stats
Flags: X - disabled, I - invalid, D - dynamic 
 #   CHAIN              ACTION                  BYTES           PACKETS        
 0   input              drop                    0               0              
 1   forward            drop                    0               0              
 2   output             drop                    0               0   


Start a traffic capture:
[admin@Mikrotik] > /tool sniffer set interface=vlan935
[admin@Mikrotik] > /tool sniffer start
I then put a laptop on the network, it received a DHCP lease.
Stop the capture, check counters, check traffic capture and show DHCP leases:
[admin@Mikrotik] > /tool sniffer stop
[admin@Mikrotik] > /ip firewall filter print stat
 Flags: X - disabled, I - invalid, D - dynamic 
 #   CHAIN              ACTION                  BYTES           PACKETS        
 0   input              drop                    656             2              
 1   forward            drop                    0               0              
 2   output             drop                    0               0      
 
[admin@Mikrotik] > /tool sniffer packet print det
 0 time=1.662 direction=in src-mac=00:1E:52:87:F4:4A dst-mac=FF:FF:FF:FF:FF:FF 
   interface=vlan935 src-address=0.0.0.0:68 (bootpc) 
   dst-address=255.255.255.255:67 (bootps) protocol=ip ip-protocol=udp size=342 
   ip-packet-size=328 ip-header-size=20 dscp=0 identification=4229 
   fragment-offset=0 ttl=255 

 1 time=1.663 direction=out src-mac=00:0C:42:43:62:C9 dst-mac=00:1E:52:87:F4:4A 
   interface=vlan935 src-address=10.35.0.1:67 (bootps) 
   dst-address=10.35.0.254:68 (bootpc) protocol=ip ip-protocol=udp size=342 
   ip-packet-size=328 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 
   ttl=16 

[admin@Mikrotik] > /ip dhcp-server lease print
Flags: X - disabled, R - radius, D - dynamic, B - blocked 
 #   ADDRESS              MAC-ADDRESS       HOST-NAME   SERVER   RATE-LIMIT   STATUS 
 0 D 10.35.0.254          00:1E:52:87:F4:4A test-lap... DHCP-...              bound 

While the input chain logs two drops and nothing in forward and output, the client still receives a lease from the router, the source MAC on the reply is the interface MAC address.
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Sat Oct 24, 2009 2:18 am

Thank you for confirming this. I have had this problem since the early 3 versions, but since I don't have a need for blocking very often, I use workarounds.

Now that this is confirmed by someone else, I would still like to know officially if this is a bug, or if the dhcp server sits outside the firewall on purpose, by design. You can block all the other servers on the mikrotik through the firewall, such as ftp, ssh, winbox, etc, without problem.
 
changeip
Forum Guru
Forum Guru
Posts: 3803
Joined: Fri May 28, 2004 5:22 pm

Re: Impossible to block DHCP Server. By design, or bug???

Sat Oct 24, 2009 5:02 am

even back in 2.8 it was this way I believe. Something to do with the kernel receiving the packets before the firewall. I tried finding that post from years ago but can't find it.
Colo and Wholesale Bandwidth Available! Sales at SanDiegoBroadband dot com
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Sat Oct 24, 2009 5:05 am

Thank you for that information.

If that is how it is, and if it must be that way, I wish those sort of things would be documented to prevent confusion.
 
User avatar
hilton
Long time Member
Long time Member
Posts: 635
Joined: Thu Sep 07, 2006 5:12 pm
Location: Jozi (aka Johannesburg), South Africa

Re: Impossible to block DHCP Server. By design, or bug???

Mon Oct 26, 2009 6:04 am

My experience is that if you run the DHCP on a VLAN interface, then the traffic is limited to just the VLAN.

For example;

vlan20 (mikrotik DHCP for this vlan only)

vlan30 (windows server DHCP for this vlan only)
Regards
Hilton
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Mon Oct 26, 2009 3:29 pm

Of course you can run dhcp on a single interface, and keep it off the others. The issue here is that once you have dhcp server running on an interface, you can NOT block dhcp on that interface (VLAN or whatever) with IP Firewall. Since 2 different VLANs are different interfaces, the traffic would be seperate, unless you intentionally bridged or routed them together. If dhcp did cross over between vlans or other interfaces, that would definitely be wrong.
 
XTLMeth
Frequent Visitor
Frequent Visitor
Posts: 54
Joined: Mon Sep 07, 2009 7:10 am

Re: Impossible to block DHCP Server. By design, or bug???

Tue Oct 27, 2009 11:23 pm

This is a linux thing not a mikrotik thing. I have been building fiewalls with linux for a long time and no matter what firewall rules I put in place dhcp still gets through whether it's a client or server on that local firewall.
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Tue Oct 27, 2009 11:26 pm

This is a linux thing not a mikrotik thing. I have been building fiewalls with linux for a long time and no matter what firewall rules I put in place dhcp still gets through whether it's a client or server on that local firewall.
Thank you for that information. I'm glad to at least know now why this issue exists, and that it isn't a Mikrotik bug. It should still be documented, however.
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Tue Oct 27, 2009 11:48 pm

I found this information online which better explains why this happens:

Normally, when programs need network access, they open
an Internet socket, which gets
any packets destined for it and can send packets after the kernel has
applied all IP Tables rules to them. So if you have a policy of
DROP, the socket will not receive or be able to
send that packet.

However, DHCP uses a RAW Internet Socket instead, and receives packets before the IP Tables processing gets it.

Because Raw sockets get packets before the IP Tables processing,
the DHCP traffic is received/sent before IP Tables can allow or deny it.
 
User avatar
Ibersystems
Forum Guru
Forum Guru
Posts: 1683
Joined: Wed Apr 12, 2006 12:29 am
Location: Cabrils, Barcelona - Spain
Contact:

Re: Impossible to block DHCP Server. By design, or bug???

Wed Oct 28, 2009 12:25 am

VERY INTERESTING.
Martín
martinruiz at ibersystems.es
Experto en redes WiFi y enlaces WiFi.

Facebook: @Ibersystems
Twitter: @Ibersystems

Certified in Traffic Shaping, Wireless, Internetworking, Routing and User Management.
MTCTCE - MTCWE - MTCINE - MTCUME - MTCRE
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8308
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Impossible to block DHCP Server. By design, or bug???

Wed Oct 28, 2009 12:52 am

yeah. on the one hand, it's useful when you don't have IP address on DHCP Interface. does anybody here have such setup? =)

on the other hand, for most users non-raw socket is enougn, so it may be a feature request - an option to select DHCP server mode =) or maybe some kind of redirection a packet to IP Firewall (/ip dhcp-server settings set use-ip-firewall=yes? :) )
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Wed Oct 28, 2009 3:30 am

Yes, it would be a great feature to have the selectable dhcp server mode, ip-mode/raw-mode.
 
XTLMeth
Frequent Visitor
Frequent Visitor
Posts: 54
Joined: Mon Sep 07, 2009 7:10 am

Re: Impossible to block DHCP Server. By design, or bug???

Wed Oct 28, 2009 6:15 am

So I was sitting around watching history channel and I was thinking about this whole issue. The idea is that if the socket is raw and the netfilter rules never see the packets how do we make them see the packets and that when I came up with a pretty cheesy way but it works.

typical setup ether1---->[dhcp-client/dhcp-server]

cheesy way ether1----[Bridge]----[bridge as dhcp-client/dhcp-server]

see the key here is as the packets enter ether1 the next stop is the bridge and as the packets enter the bridge they can be inspected before they get to the bridge which is acting as the dhcp-client/dhcp-server


So create a bridge and attach the ethernet interface to the bridge. then take your dhcp server and reassign it to the bridge instead of the ethernet interface. Then with a rule like this:

/interface bridge filter
add action=drop chain=input comment="" disabled=no ip-protocol=udp mac-protocol=ip src-port=67-68

stopped dhcp from working. I don't know if this helps you at all but this is one method for containing the dhcp packets that otherwise couldn't be stopped.

Sorry of this post is a little scattered. I get that way sometimes. :-D

EDIT: I just realized you were using a bridge after reading back but I think you were using /ip firewall filter. Anway my example uses /interface bridge filter which applies to the bridge and allows you to catch packets comming into the bridge before the interface. Anyway when I use the rule I posted My dhcp does stop working.
 
jandafields
Forum Guru
Forum Guru
Topic Author
Posts: 1514
Joined: Mon Sep 19, 2005 6:12 pm

Re: Impossible to block DHCP Server. By design, or bug???

Wed Oct 28, 2009 3:56 pm

That's great to know that the bridge firewall can intercept those packets! You are right, I was using the IP Firewall option, not the Bridge Firewall.

As for the raw versus ip option, I put in a feature request and support said "not currently, but probably in the future".
 
XTLMeth
Frequent Visitor
Frequent Visitor
Posts: 54
Joined: Mon Sep 07, 2009 7:10 am

Re: Impossible to block DHCP Server. By design, or bug???

Wed Oct 28, 2009 5:20 pm

I would be careful doing any type of filtering on the bridge. As far as I known it's not stateful.
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8308
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Impossible to block DHCP Server. By design, or bug???

Wed Oct 28, 2009 7:58 pm

yes, but if you drop not only 67-68/udp, but also dst-address=255.255.255.255 and your_router's_ip, then it should not block something important =)

btw, nice idea :)
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
Ilevene
just joined
Posts: 3
Joined: Sun Sep 15, 2013 7:39 pm

Re: Impossible to block DHCP Server. By design, or bug???

Sat May 17, 2014 8:03 pm

Here's my problem. I have 2 Mikrotiks in a central location, acting as DHCP servers. They are being forwarded bootp traffic from 1800 different subnets, where each subnet has a Cisco router, switch, and wireless lan controller. My Mikrotiks are only there to act as DHCP server and receive traffic based on the router in the remote location having a helper address. So the clients do not ARP on the Mikrotiks. What I see is a DHCP pool filling up with addresses having no MAC address associated. Even if I turn on "add arp for leases", the addresses in the DHCP leases table still have an IP but no MAC. This runs my pool out of addresses and results in DHCP pool exhaustion. I sniffed the traffic and I see in the traces DHCP requests coming from other IP addresses.

From what I know, a DHCP request should come from only another source with no IP address, as a broadcast. A DHCP request. It should not come from another address.

Is there a way I can set up some sort of filter on the firewall to block all bootp traffic from anything other than an accepted source, i.e the downstream router?

I have attached the sniff trace of this condition. rename it as a .cap file.
You do not have the required permissions to view the files attached to this post.
 
Florian
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Sun Mar 13, 2016 9:45 am
Location: France

Re: Impossible to block DHCP Server. By design, or bug???

Tue Mar 22, 2016 9:56 pm

That's great to know that the bridge firewall can intercept those packets! You are right, I was using the IP Firewall option, not the Bridge Firewall.

As for the raw versus ip option, I put in a feature request and support said "not currently, but probably in the future".

Hello there,

Any news on that ? My ISP need to receive DHCP Request with a priority of 6. In the current state, I can't "manipulate" the dhcp packet with the firewall "stack", so, no connexion... my crr 1009 is a 400 euros paper weight right now :/
- Sorry for my english -
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Impossible to block DHCP Server. By design, or bug???

Tue Mar 22, 2016 11:02 pm

Hello there,

Any news on that ? My ISP need to receive DHCP Request with a priority of 6. In the current state, I can't "manipulate" the dhcp packet with the firewall "stack", so, no connexion... my crr 1009 is a 400 euros paper weight right now :/
Is this for your CCR to be a dhcp client, or a dhcp relay?
If client, you should be able to set priority on such traffic using the mangle table's output chain.
/ip firewall mangle
add chain=output out-interface=WAN protocol=udp dst-port=67 action=set-priority new-priority=6

(replace WAN with whichever interface has the dhcp client configured, e.g. ether1-gateway)
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
Florian
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Sun Mar 13, 2016 9:45 am
Location: France

Re: Impossible to block DHCP Server. By design, or bug???

Tue Mar 22, 2016 11:10 pm

Hello there,

Any news on that ? My ISP need to receive DHCP Request with a priority of 6. In the current state, I can't "manipulate" the dhcp packet with the firewall "stack", so, no connexion... my crr 1009 is a 400 euros paper weight right now :/
Is this for your CCR to be a dhcp client, or a dhcp relay?
If client, you should be able to set priority on such traffic using the mangle table's output chain.
/ip firewall mangle
add chain=output out-interface=WAN protocol=udp dst-port=67 action=set-priority new-priority=6

(replace WAN with whichever interface has the dhcp client configured, e.g. ether1-gateway)
My ccr is a dhcp client in that situation.

And your solution doesn't work from what I understand, because the dhcp request is a raw socket thing, and doesn't enter in the firewall stack.
- Sorry for my english -
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Impossible to block DHCP Server. By design, or bug???

Tue Mar 22, 2016 11:22 pm

My ccr is a dhcp client in that situation.

And your solution doesn't work from what I understand, because the dhcp request is a raw socket thing, and doesn't enter in the firewall stack.
Actually, you're comparing apples and oranges. This thread is about blocking inbound DHCP request frames from reaching a dhcp server process listening on an interface. The firewall (i.e. netfilters package) can't interfere with / modify these frames due to the fact that the dhcp daemon apparently binds the raw ethernet interface and not a UDP socket - so it has the same access to an interface that sniffer would - namely it sees the frames before they are passed to the firewall....

However, your situation is that you want to modify packets as they are being sent from the dhcp client process, which is different, so it's entirely likely that you can just modify the priority. (which if memory serves is a field in a VLAN header, not a packet header) - now it's still possible that the dhcp client process is also operating at a raw frames level and would thus bypass the mangle table as well, but you could watch the rule for hits, and verify with sniffer+wireshark that the priority is being set properly. If the mangle table doesn't see any hits, then you could also use the bridge filter solution above to modify the outgoing DHCP requests. (output bridge filter chain) Honestly, I'm not sure why the ISP requires that a priority be set - is this using some kind of WiMax connection? (that's the only thing I've ever messed with that maps traffic based on priority as a pure requirement)
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
Florian
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Sun Mar 13, 2016 9:45 am
Location: France

Re: Impossible to block DHCP Server. By design, or bug???

Tue Mar 22, 2016 11:38 pm

My ccr is a dhcp client in that situation.

And your solution doesn't work from what I understand, because the dhcp request is a raw socket thing, and doesn't enter in the firewall stack.
Actually, you're comparing apples and oranges. This thread is about blocking inbound DHCP request frames from reaching a dhcp server process listening on an interface. The firewall (i.e. netfilters package) can't interfere with / modify these frames due to the fact that the dhcp daemon apparently binds the raw ethernet interface and not a UDP socket - so it has the same access to an interface that sniffer would - namely it sees the frames before they are passed to the firewall....

However, your situation is that you want to modify packets as they are being sent from the dhcp client process, which is different, so it's entirely likely that you can just modify the priority. (which if memory serves is a field in a VLAN header, not a packet header) - now it's still possible that the dhcp client process is also operating at a raw frames level and would thus bypass the mangle table as well, but you could watch the rule for hits, and verify with sniffer+wireshark that the priority is being set properly. If the mangle table doesn't see any hits, then you could also use the bridge filter solution above to modify the outgoing DHCP requests. (output bridge filter chain) Honestly, I'm not sure why the ISP requires that a priority be set - is this using some kind of WiMax connection? (that's the only thing I've ever messed with that maps traffic based on priority as a pure requirement)

Thx for the input. I tried mangle, and it does'nt work.

I don't really get the bridge thing.

My wan interface is a vlan interace (vlan832), linked to ether8
/interface vlan
add interface=ether8 name=vlan832-orange vlan-id=832 mtu=1500 arp=enabled use-service-tag=no

and this is a part of my dhcp client :
/ip dhcp-client
add interface=vlan832-orange disabled=no add-default-route=yes default-route-distance=1 use-peer-dns=yes use-peer-ntp=yes dhcp-options=hostname,clientid,authsend,userclass,vendor-class-identifier

My "lan" interface is a classic ethernet one.

A bridge is composed by multiples interface, right ? So, "what" do I bridge ?

Sorry if this us basic, but I'm a little lost.

Thx for your input anyway, it's appreciated :)


(oh by the way, the isp is Orange, the biggest french one, for fiber access)
- Sorry for my english -
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Impossible to block DHCP Server. By design, or bug???

Tue Mar 22, 2016 11:44 pm

make a bridge called WAN
/interface bridge add name=WAN

connect the ether8 interface to it:
/interface bridge port add interface=ether8 bridge=WAN

move the vlan interface off of ether8 and onto the WAN bridge
/interface vlan set [find where name=vlan832-orange] interface=WAN

Then make a bridge filter rule:
/interface bridge filter add action=set-priority chain=output dst-port=67 out-bridge=WAN ip-protocol=udp mac-protocol=ip \
new-priority=6 out-interface=ether8
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
Florian
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Sun Mar 13, 2016 9:45 am
Location: France

Re: Impossible to block DHCP Server. By design, or bug???

Wed Mar 23, 2016 12:13 am

make a bridge called WAN
/interface bridge add name=WAN

connect the ether8 interface to it:
/interface bridge port add interface=ether8 bridge=WAN

move the vlan interface off of ether8 and onto the WAN bridge
/interface vlan set [find where name=vlan832-orange] interface=WAN

Then make a bridge filter rule:
/interface bridge filter add action=set-priority chain=output dst-port=67 out-bridge=WAN ip-protocol=udp mac-protocol=ip \
new-priority=6 out-interface=ether8
Thx, I just tried, but the bridge filter rule does nothing, the counters stay at 0. For the sake of it I tried to change to out-interface to vlan832-orange, same thing.
- Sorry for my english -
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Impossible to block DHCP Server. By design, or bug???

Wed Mar 23, 2016 4:55 pm

Thx, I just tried, but the bridge filter rule does nothing, the counters stay at 0. For the sake of it I tried to change to out-interface to vlan832-orange, same thing.
Try in-bridge instead of out-bridge or just leaving no bridge specified?

Also - you might grab a quick paket sniffer capture to disk and open it in wireshark to double-check the port number and so forth.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
Florian
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Sun Mar 13, 2016 9:45 am
Location: France

Re: Impossible to block DHCP Server. By design, or bug???

Wed Mar 23, 2016 5:55 pm

Thx, I just tried, but the bridge filter rule does nothing, the counters stay at 0. For the sake of it I tried to change to out-interface to vlan832-orange, same thing.
Try in-bridge instead of out-bridge or just leaving no bridge specified?

Also - you might grab a quick paket sniffer capture to disk and open it in wireshark to double-check the port number and so forth.

Can't in-bridge with an output chain. The logic seems good, the packet sniffer show that dhcp packet, dst port 67 are emitted from the WAN bridge, but still, the bridge filters is not used...

Thx a lot for your time, but I'll give up on this one. Using bridge is not a good solution for my anyway. Either Mikrotik tweak their dhcp client, or I'll sell this CCR which is useless now.
- Sorry for my english -
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Impossible to block DHCP Server. By design, or bug???

Wed Mar 23, 2016 7:07 pm

Does the CCR have a hardware switch on it? (too lazy and braindead today to go look at the product flier on routerboard.com)

If so, there's an option in the HW switch to twiddle things, including the Dot1P priority value - my 2011 has settings for this, and perhaps this would be the best way to do it w/o using a bridge.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
Florian
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Sun Mar 13, 2016 9:45 am
Location: France

Re: Impossible to block DHCP Server. By design, or bug???

Wed Mar 23, 2016 7:58 pm

Does the CCR have a hardware switch on it? (too lazy and braindead today to go look at the product flier on routerboard.com)

If so, there's an option in the HW switch to twiddle things, including the Dot1P priority value - my 2011 has settings for this, and perhaps this would be the best way to do it w/o using a bridge.
Yes there is an hw switch. Can you put a priority on only one type of traffic with the dot1P function ?
- Sorry for my english -
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: Impossible to block DHCP Server. By design, or bug???

Wed Mar 23, 2016 8:14 pm

I would think that you could limit the scope of the rule with some Match criteria -

My 2011 has an IP section, and I would assume that you could set protocol = udp, and dst port = 67, and I'd list ports = ether8 (and choose the proper switch if there are multiple hw switches in the device). I'd say action=new VLAN priority = 6
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
onlineuser
Member Candidate
Member Candidate
Posts: 213
Joined: Thu Aug 06, 2015 12:10 pm

Re: Impossible to block DHCP Server. By design, or bug???

Sun Mar 24, 2019 8:41 am

There is another discussion on the topic: viewtopic.php?f=2&t=140569&p=722876

Who is online

Users browsing this forum: Google [Bot] and 53 guests