NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
RBR50 in AP mode but DHCP on by itself
Hi All, I'm using RBR50 in our small company, which sat behind an UTM and running at AP mode. Our purpose is to provide small amount of WIFI connection only and would like our UTM to handle all ...
Alan_LR wrote:
Upon investigation is that their IP address was not the usual 192.168.1.X but 10.0.0.X, and further check that this IP range is provided by the RBR50! The problem is occasional as only some PC had issues but not all.
The Orbi DHCP function definitely can be enabled or disabled. Access mode should disable Orbi DHCP.
Some questions:
- What firmware release is on this Orbi router? (upper right hand corner of the web interface)
There has been a recent firmware update and the forum is sensitive to "what happens" when it is applied. - How were these 10.0.0.x IP addresses traced to the Orbi? Is there a setting in the Orbi web interface saying that it is providing DHCP in that range? (web interface, Advanced Tab, Setup, LAN Setup)
What this sounds like is that there is a new DHCP server on the network. All sorts of devices can provide DHCP. My Pi-hole servers, for example, can do DHCP in addition to providing DNS resolution.
CrimpOn wrote:
The Orbi DHCP function definitely can be enabled or disabled. Access mode should disable Orbi DHCP.
This is what I expected. Upon setup to Access mode, there are no DHCP selection in ALL web manual available.
CrimpOn wrote:
- What firmware release is on this Orbi router? (upper right hand corner of the web interface)
There has been a recent firmware update and the forum is sensitive to "what happens" when it is applied.- How were these 10.0.0.x IP addresses traced to the Orbi? Is there a setting in the Orbi web interface saying that it is providing DHCP in that range? (web interface, Advanced Tab, Setup, LAN Setup)
What this sounds like is that there is a new DHCP server on the network. All sorts of devices can provide DHCP. My Pi-hole servers, for example, can do DHCP in addition to providing DNS resolution.
Q1 - V2.7.3.22
Q2 - I tried to login the 10.0.0.x gateway which is 10.0.0.1 by HTTP. It ask for login in and password just as any router's response. At that moment I do not aware the RBR50 is the gateway and I skipped the login, and of course it shown 401 error. However at the browser tab it displayed "Netgear R6150" and I checked this is the original model name of RBR50. Therefore I decided to remove the RBR50 from network. Once it was removed, client PC can obtain the original IP after refreshing the LAN connection. This is a method of deduction of possibility.
New DHCP server -- since I'm the only person actually take care the network equipment, I'm sure there is NO any device with DHCP function added by myself. I used to thought the possibility that somebody plugged a router by themselves without my knowledge, but I had personally went through almost all corners of company but not find anything.
Therefore everything points to the RBR50.
DHCP issues are not easy to resolve. If there are absolutely zero DHCP problems when the Orbi is disconnected, then I tend to agree that something connected to the Orbi is the source of the problem. With the Orbi DHCP function being disabled, I lean toward something connected.
My approach would be to try to find this DHCP server. I would set up Wireshark on a PC to capture all ethernet packets, then drop the IP reservation and request it until the PC gets a 10.0.0.x IP address. The easiest way might be to use the Network Control Panel, "Disable" the ethernet interface, then "Enable" the interface. That will force a new DHCP request.
Such as Open a DOS Wiindow and Network Control Panel
- In the DOS window type ipconfig /all
- See what the IP address is.
- If it begins with 10.0.0 terminate the experiment
- If not, type ipconfig /release
- Go to the Control Panel, Disable the interface then Enable the interface
This forces the interface to do a DHCP request - Go back to step 1 in the DOS window.
In Wireshark, set a display filter of "dhcp" and it will show every DHCP request and response. If there is a DHCP response offering a 10.0.0.x IP address, the MAC address of the DHCP server is the key item that allows you to find it.
I am not confident that only routers can act as DHCP servers. My Pi-holes can (although I have that feature turned off.)
At the very least, it would be helpful to make a list of every device that is connected to the Orbi system (both wired and WiFi). A more primitive experiment would be to disconnect one device at a time and see if the problem disappears when a specific device is disonnected.
(Being a little OCD, I prefer the "collect packets" approach to the "shoe leather" approach.)
Geez. Forgot to ask the obvious.
These PC's that are getting incorrect IP addresses. Are they connect to the Orbi LAN ports or Orbi WiFi?
I have never heard of Orbi (or any WiFi router) providing DHCP service to its WAN port.
In AP mode, broadcast packets go everywhere. (For example, in the WAN port and out all the LAN ports) If a device that is not connected to the Orbi is getting rouge DHCP responses to its DHCP broadcasts, I am even more convinced that it is not the Orbi itself.
CrimpOn wrote:Geez. Forgot to ask the obvious.
These PC's that are getting incorrect IP addresses. Are they connect to the Orbi LAN ports or Orbi WiFi?
I have never heard of Orbi (or any WiFi router) providing DHCP service to its WAN port.
In AP mode, broadcast packets go everywhere. (For example, in the WAN port and out all the LAN ports) If a device that is not connected to the Orbi is getting rouge DHCP responses to its DHCP broadcasts, I am even more convinced that it is not the Orbi itself.
Many thanks for the suggestion. I'm now checking again after weekend. And yes the previous issue are all connected through LAN but the Orbi only connected itself at LAN port and none of its other LAN port are connected to any PC.
After removing the Orbi from network for 2 days I will try to put it back to see any issue again. Anyway since I found the firmware I'm using is already the latest, I'm thinking whether it is caused by automatic firmware update which caused the chaos.