a DHCP static IP bug..

[Eric]

I can confirm this bug (I was able to reproduce it), and have now committed a fix. Thanks for pointing this out.

[fox85]

I'm investigating this now, will report back when I know more.

Thank you, will waiting for the fix

[fox85]

I can confirm this bug (I was able to reproduce it), and have now committed a fix. Thanks for pointing this out.

Hi， Eric

Thanks for the fix

I tested your fix, now it can block the mismatch device access to WAN, but LAN is still can access.

And I found the mismatch device would disturbe the legal device ,cause the legal one ping failed .... means lost connection..

[Eric]

Hmm... I see how that could cause problems. I'll see if I can move the logic into ebtables which should block packets at layer2 instead of layer3 like iptables and therefore prevent access to the LAN too. I'll post here if/when I get that working.

[fox85]

Hmm... I see how that could cause problems. I'll see if I can move the logic into ebtables which should block packets at layer2 instead of layer3 like iptables and therefore prevent access to the LAN too. I'll post here if/when I get that working.

Nice, waiting for your work,thanks Eric

[Eric]

Bad news... this isn't going to work. Merely blocking access to the WAN is as much as I can do.

The switch drivers of a lot (if not most) routers, don't route packets through ebtables. ebtables works on wireless traffic, but anything connected via a wired connection to the same switch still goes through even if it should get blocked by ebtables.

[ispyisail]

A naughty person could stop others accessing there allowed quota

[ispyisail]

What about a simple captive portal?

[Eric]

No... the fix above prevents a user from stealing quota. This was implemented for a while, but there was a problem with that implementation in the latest release that is now fixed.

The issue noted above that cannot be resolved only would allow LAN access (which is not tracked by quotas), not WAN access to users that set a static IP address that already exists on the network. The problem is the wired switch drivers completely by-pass the filtering code in ebtables or iptables, so there is no easy way around this.

[fox85]

Sounds like related to kernel issue, switch driver by-pass the tables rule