Re: DHCP woes

one thing to notice (because it's not very obviously documented)
in Firewall > Firewall Settings
you'll find by default
Green Open
Blue Open (I think - I don't have one to hand to test)
It's normal to set these to Half-Open once you've started setting up the 
IPCOP, or to Closed - but I've never done that.

this means
Open = all outbound traffic is allowed
Closed = all outbound traffic is refused, except that which is allowed 
by specific rules
Half Open = as closed, except that all traffic is allowed to IPCOP to 
the default services

so for example if you set the interface to Half Open (which is a normal 
thing to do) then in addition to any firewall rules you create, you will 
also have
DNS allowed to IPCOP
DHCP allowed to IPCOP
NTP allowed to IPCOP
if the Proxy is on, then you'll have HTTP allowed to IPCOP & hence outward.

now I'm not sure that the firewall rules in this situation cope properly 
with DHCP traffic.  I have seen it in other situations where DHCP 
addresses leak from a dedicated DHCP server on Orange (Open) through to 
Green, which didn't ought to happen but it did. Also to further confuse 
things IPCOP was only providing DHCP on Blue.
The traffic must have been:
device on green starts DHCP exchange with a broadcast
traffic arrives at Green = half-open, IPCOP DHCP is off so this out to 
be blocked, but arrives on Orange
dedicated DHCP server on Orange replies back to IPCOP
IPCOP relays the DHCP response back to the device on Green (obviously 
the server on Green doing DHCP was busier at the time). Device now can't 
connect as it has a Orange address.
(I know this is a messy scenario but it was to fix a particular problem 
and I mention it in case it throws some light on Joe's issue)

so in summary, you might want to set the Blue & Green interfaces to 
Half-Open or to Closed (be careful to create some rules allowing you 
access to IPCOP first or you might lock yourself out of IPCOP)

if that fails follow Eric's advice and look in the files he mentions, 
and see if you can document it doing the wrong things, then someone 
might be able to fix it.

Dave


On 19/06/2017 21:32, Eric Oberlander wrote:
> Sorry, to correct my previous post, in wireless.cgi, if the MAC address is
> already in the list [of static devices] the 'add device' icon is greyed out.
>
> Eric
>
> On 19 June 2017 at 20:40, Eric Oberlander <[email protected]> wrote:
>
>> Hi
>> It's a good few years since I knew this all backwards, but files to look
>> at would be
>> /var/ipcop/dhcp/settings
>> /var/ipcop/dhcp/fixedleases
>> /var/run/dnsmasq/dnsmasq.leases
>>
>> I think the 'add fixed lease' icon should be greyed out if the IP address
>> is in the 'fixedlease' file. I'd have to dig through dhcp,cgi to check. Try
>> adding and deleting fixed leases and see how the files change, and if the
>> correct, or expected, values are saved.
>>
>> How long are the dynamic leases? Are they 60 minutes, or over a number
>> days or longer? When testing I cut it down to 10 minutes so I could watch
>> the Requests, Offers and Acks in the system logs, which would also be a
>> good place to look.
>>
>> It goes without saying that green and blue are on different subnets. Are
>> they saved correctly in the settings file? Are the static leases within the
>> range of dynamic leases? Just guessing now...
>>
>> Eric
>>
>>
>> On 19 June 2017 at 18:13, Joe Acquisto-j4 <[email protected]> wrote:
>>
>>>>>> On 6/19/2017 at 10:17 AM, Chris Bell <[email protected]>
>>> wrote:
>>>> On Monday 19 Jun 2017 09:12:45 Joe Acquisto-j4 wrote:
>>>>> IPCop v2.1.9
>>>>>
>>>>> I continue to have DHCP oddities.   For instance one device, on GREEN
>>>>> segment, was handed out a dynamic address for BLUE.  That has happened
>>> to
>>>>> several devices.
>>>>>
>>>>> GREEN and BLUE are on different NIC.   However, after several power
>>> cycles
>>>>> on the device, now it is being handed out a GREEN address.  One
>>> oddness is
>>>>> that the "edit" icon is greyed out for that address.
>>>>>
>>>>> I added that device to the "fixed lease" list yet it continues to hand
>>> it
>>>>> GREEN address.
>>>> The BIOS in some boxes finds devices in random order, first to reply,
>>> and
>>>> passes
>>>> the list to Linux. I had to sort this while testing a shorewall setup by
>>> . . . .
>>>> --
>>>> Chris Bell
>>>> website chrisbell.org.uk
>>> This applies to the IPCOP power cycles, correct?  I should have been more
>>> specific, it is the client device power cycles.  Sorry.
>>>
>>> joe a.
>>>
>>>
>>>
>>>
>>> ------------------------------------------------------------
>>> ------------------
>>> Check out the vibrant tech community on one of the world's most
>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>> _______________________________________________
>>> IPCop-user mailing list
>>> [email protected]
>>> Manage your subscription or unsubscribe
>>> https://lists.sourceforge.net/lists/listinfo/ipcop-user
>>>
>>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> IPCop-user mailing list
> [email protected]
> Manage your subscription or unsubscribe
> https://lists.sourceforge.net/lists/listinfo/ipcop-user


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user