NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Edit/Add new IP reservations
I have an RBR50v2 Orbi router and 2 satellites with FW ver 2.7.5.6. I have entered 15, or so, reserved internal IP addresses using "Advanced > Security > Access Control". All works well.
The issue is, if I edit existing entries or add new entries, boot my router/satellites, log back into my router and go to "Basic > Attached Devices", the changes do not show up.
It seems like I had this problem in the distant past and had to delete all reserved IP address entries in "Access Control", boot the system and re-enter all IP reservations. Is that the work around for this issue?
Any help is appreciated.
18 Replies
Device IP assignments are made on this page:
reserved internal IP addresses using "Advanced > Security > Access Control"
That screen does mac access control, not IP address reservation.
Did you mean to say Advanced->Setup->LAN Setup?
The issue is, if I edit existing entries or add new entries, boot my router/satellites, log back into my router and go to "Basic > Attached Devices", the changes do not show up.
If you are reserving a different IP address than the one currently in use, then it can take a while - the original IP address is used until the client requests a new one.
Thank you guys for your replies. StephenB, sorry, you are right, I mean Advanced > Setup > LAN Setup.
So if I edit (change existing) an IP address or MAC address using "Advanced > Setup > LAN Setup", I should wait for a period of time for the changes to take place? Any idea of how long (order of magnitude) I will need to wait? I presume the timing is a product of my ISP, but normally 1hr, several hrs, next day?
I should be able to add a new IP address which should take place right away, correct?
Thanks again for all your help.
I presume the timing is a product of my ISP, but normally 1hr, several hrs, next day?
No, it's not about your ISP. When a client requests an IP address, the router gives the client a "lease period". After the lease period ends, the client asks for another address.
You can try to force the switch by disconnecting the client from the router and then reconnecting it. If that fails, you can power down the client, restart the router, and then power up the client.
I should be able to add a new IP address which should take place right away, correct?
If the client is not connected, then the assignment should take place right away.
My observation*** of Netgear's DHCP programming is that when a device issues a DHCP renewal request, the Orbi router honors the request. In essence saying, "you've got it. you can keep it." It appears that what the router finds in its internal ARP table takes precedence over what is in the LAN Setup table.
I have found only two ways to force the router to tell the device to change IP address to what is in the LAN Setup table:
- Reboot the router. This forces every device connected to the router to go through the connection process. With the ARP table having no entry for any device, the router first looks in the LAN setup table. If no IP address is found there, one is randomly assigned from the DHCP pool.
- Power off the device. Define another device with the IP address that the device currently has and connect it to the network. Then, power up the device. When it asks for an IP address, the router will not find it in the ARP table because the device with the Static IP is in the ARP table, and then the router will go through the process of looking in the LAN Setup table.
This is not what we humans expect and would prefer.
*** An interesting experiment to perform:
- Power off a device.
- Change the IP in the LAN Setup table.
- Power the device back on.
- Check (on the device) to see what IP address is assigned.
My guess is that ARP table entries will "time out" if a device is left disconnected from the network. Internet search shows ARP table timeout varies by type of system (from seconds to hours).
Thank you for all your terrific support. I certainly appreciate the time you take for your replies.
CrimpOn, your reply was super helpful. I really thank you for that. You were correct, it appears that the ARP table entries indeed "time out" after leaving the device powered off for an hour or so.
Couple last questions please:
In my Orbi router, I goto the Advanced (Tab) > Setup > LAN Setup, and I checked "Use Router as DHCP Server" and I entered a "Starting IP Address" and I entered an "Ending IP Address". In addition, I have included all (40) of my Address Reservations within the "Starting" and "Ending" IP Address range. I presume, though, the "Starting" and "Ending" address range is to be used for Non-Reserved IP Addresses?? I did not Reserve IP Addresses for my two Orbi Satellites and the DHCP selected IP addresses for these devices were indeed selected inside the range that I had setup. In my thinking, the "Starting" and "Ending" address range should be set for RESERVED addresses since the "number of entries" for this type of address is a known count so that I can set the range intelligently, while the count of addresses for Non-Reserved addresses is not necessarily known. Are my thoughts correct?
Is it good practice to give each of my two Orbi satellites a Reserved IP Address? Is 40 Reservations reasonable? I give all my household devices a reserved IP addresses, is that not reasonable?
Is there a limit of IP Address Reservations I can add to my Orbi router?
There are differing opinions on the best way to manage the "range" of the DHCP process.
My opinion is this:
- Reserved IP addresses should not be part of the DHCP "pool". Suppose a device with a reserved IP address is not currently connected to the network (perhaps a mobile phone) and some other random device connects and makes a DHCP request. These is a possibility that this device may be assigned the IP that was supposed to be reserved for that phone. What happens if the phone now appears and asks to connect? It cannot have the reserved IP because some other device already has it.
- The DHCP "pool" should be large enough to handle devices which connect to the network and do not have reserved IP addresses.
- In my case, IPs from 192.168.1.2 through 192.168.1.100 are set aside for reserved addresses and IPs from 192.168.1.101 to 192.168.1.150 are in the "pool". IPs from 192.168.1.151 through 192.168.1.254 are not defined.
- I definitely endorse reserving IP addresses for satellites, printers, NAS devices, etc.
(being a wee bit OCD) I reserve IP addresses for every device which is expected to be connected to the network and have set aside groups of IPs for types of devices (cameras, smart plugs, etc.)
My LAN Setup table currently has 59 devices.
So the "pool" is defined by "Use Router as DHCP Server" with a Starting and Ending IP Address range? And the "undefined" range is not used at all, correct?
FYI, Been a long standing standard networking practice for a long time, IP address RESERVATIONSs should be with in the DHCP IP ADDRESS POOL, i.e. 192.168.1.100 to 192.168.1.200 can be a pool range. STATIC IP addresses are set ON devices and are set outside of the DHCP IP ADDRESS POOL range. Either side of the afore mentioned example range is out side of the pool and can be used by STATIC IP addressed devices. IP address reservations are handled and managed by the DHCP service inside the pool, not outside of it. How it's designed. IP addresses are first Dynamically handed out to devices making a connection. If an IP address is already taken by another, then the next 1st available address it given out. Even if the IP address is already RESERVED in the DHCP pool range, then the next availble IP address is given out by the DHCP serivce, regardless if it's Dynamic or Reserved. How the DHCP system works and intended how to work for most home class router systems.
So the "pool" is defined by "Use Router as DHCP Server" with a Starting and Ending IP Address range? And the "undefined" range is not used at all, correct?
https://kb.netgear.com/25722/How-do-I-reserve-an-IP-address-on-my-NETGEAR-router
Reserved IP addresses should not be part of the DHCP "pool".
FWIW, I also keep them out of the pool. But I'd consider it a bug if the router were to assign a reserved address to a different device - even if the reserved address is not connected at the time.
I definitely endorse reserving IP addresses for satellites, printers, NAS devices, etc.
You should reserve the IP address for any destination of a port forwarding rule.
I reserve NAS, printers, desktop PCs connected over ethernet, and smart/managed switches.
So the "pool" is defined by "Use Router as DHCP Server" with a Starting and Ending IP Address range? And the "undefined" range is not used at all, correct?
Yes. Though "undefined" just means that CrimpOn has chosen not to reserve those addresses. Note the last address in the subnet (.255) is a broadcast address, so should not be used for any client.
Use router as DHCP server means that when any device on the network broadcasts a DHCP request, the router will answer it. If the feature is off, then the router ignores DHCP requests. (Some users deliberately set up another device to manage IP addresses on the network and disable their WiFi router DHCP to prevent conflicts.)
When the router receives a DHCP request, it goes through a process to determine how to respond. My analysis is that it does this:
- Looks in the router ARP table to see if a device with that MAC address is already on the network. If so, the router says "Use this IP address I found in my ARP table."
(this is the part that we humans find annoying and wish the router would not do this.) - If not, the router looks in the LAN Setup table for that MAC address. If an entry is found, it responds, "Use this IP address I found in my LAN Setup table"
- If the MAC address is not in the LAN Setup table, the router looks for an open entry in the DHCP "pool" and says, "Use this IP address that appears to be available from the pool."
(I do not know if the router starts by looking from the bottom of the table or if it starts from the last IP address that was handed out. Would be something to experiment with (if I cared).
I certainly appreciate all the great help you all have given me. Please let me know if I am "over asking" my welcome. One more question.
When I goto "Advanced > Security > Access Control ", I see a list of attached devices with a status, for each device, listed as "Allowed" or "Blocked". If I scroll down just below this list, I see another list entitled "View list of allowed devices not currently connected to the network". In that quite long list, there are many device MAC addresses that are unknown to me. Can I delete all the devices that I think are not needed any more? I presume these devices are "not needed" old devices that I no longer own or devices from guests that I do not need any more. Many/Most of these entries are named "WATCH". REALLY unsure what that device entry was/is. Is this, basically, the ARP table for devices that are turned off?
If I happen to delete an address, from this list, that IS relevant, will it not reappear the next time the device is turned on and back off again?
To remove devices do I merely check the box next to the device and click "Remove from the List" button?
When I goto "Advanced > Security > Access Control ", I see a list of attached devices with a status, for each device, listed as "Allowed" or "Blocked". If I scroll down just below this list, I see another list entitled "View list of allowed devices not currently connected to the network". In that quite long list, there are many device MAC addresses that are unknown to me. Can I delete all the devices that I think are not needed any more? I presume these devices are "not needed" old devices that I no longer own or devices from guests that I do not need any more. Many/Most of these entries are named "WATCH". REALLY unsure what that device entry was/is. Is this, basically, the ARP table for devices that are turned off?
The list is just what it says - devices that are allowed to join the network, but which are off-line at the moment.
Personally I just leave that control off. The security benefits are minimal, since anyone who can crack your wifi password also has the skills to spoof a MAC address. Plus I discovered earlier this week that this feature wasn't working correctly on my 870. (No idea if the issue I found also applies to the rbr50 or not)/
If you allow new devices to join the network, then it is certainly safe to delete old items on the "not connected to the network" list.
If you do not allow new devices to join then network, then there is some risk that you might remove a device that is still on your network. In that were to happen, you could always add it.
You do want to be careful with phones and tablets, since both Android and Apple phones/tablets have a feature that randomizes their MAC address. So if you use MAC access controls, you need to make sure that those phones/tablets are configured properly. In the case of Apple, you'd want the "private wi-fi address" setting for your network to be set to either "Fixed" or "Off" "Rotating" will not work.
- Looks in the router ARP table to see if a device with that MAC address is already on the network. If so, the router says "Use this IP address I found in my ARP table."
Can I delete all the devices that I think are not needed any more?
Certainly. I agree with StephenB that Access Control is more trouble than it could possibly be worth, so I never enable it. If one of those devices happens to return and the user remembers my WiFi password, it simply gets connected. I also clear the table under that one. (Blocked Devices that are not connected - just in case anything got put into that table.)
