Cascade Router DHCP second network

[septer012]

I have a problem, maybe one of you can help with, or let me know what blunder I have made.

I have fiber connection from AT&T to a network gateway, copper to a Pace 5268ac residential gateway, and copper to an Asus RT-AC68R.

Fiber -> NG -> RG (192.168.1.x, DHCP) -> (WAN) RT-AC68R (192.168.2.x , DHCP) -> any device.

Occasionally devices on my internal network are receiving DHCP responses from the RG 1.x network, instead of the 2.x network.

Should DHCP pass through the WAN port?
Is there a way on this router to block DHCP? (I believe both IPTABLES and VLANs are not available natively.) (Router is running WRT-Merlin)

Thank You for any support.

septer012

 

[septer012]

I found IPTABLES and user scripts. So I guess I can stop it with IPTABLES. Why is there a default rule to allow INPUT source 67 destination 68 for DHCP through the WAN?

 

[umarmung]

If this is about Asus Merlin, can you post in the appropriate forums, please? Many of only watch for non-Merlin posts, which is hard enough already to (visually) filter out.

 

[septer012]

Nope not specifically about Merlin. Just routers and networking. Sorry if I wasted your time.

 

[degrub]

If you don't need double NAT, set the first device into "bridge mode" and let the second device function as a router.

 

[ColinTaylor]

Should DHCP pass through the WAN port?

No it shouldn't and the Asus doesn't pass DHCP traffic through the router. The only way I can think this is possible is if you still have the Wi-Fi enabled on the Pace.

Why is there a default rule to allow INPUT source 67 destination 68 for DHCP through the WAN?

That rule is there for the router's WAN interface because the router is a DHCP client. It is not forwarding it to the LAN.

 

[septer012]

If you don't need double NAT, set the first device into "bridge mode" and let the second device function as a router.

Thanks, unfortunately there isn't bridge mode available, only DMZ+ on the residential gateway.

No it shouldn't and the Asus doesn't pass DHCP traffic through the router. The only way I can think this is possible is if you still have the Wi-Fi enabled on the Pace.

Thanks, on an device in the internal network I was running wireshark, I see DHCP from both routers. Wi-Fi is disabled on the Pace. I have a DirecTV receiver connected wired on the RG network and possibly wirelessly on the internal network. Possibly DHCP is passing through there.

That rule is there for the router's WAN interface because the router is a DHCP client. It is not forwarding it to the LAN.

This makes sense. Thanks.

 

[MichaelCG]

DMZ+ is what you are after there. It "should" pass through the public IP to your Asus.

However, that is unlikely to fix your issue. For the issue related to DHCP, there has to be something bridging Layer2 between both subnets.

 

[coxhaus]

If you are receiving DHCP requests on a second router you have a firewall problem or you could have a wiring problem. Maybe you have the 2 LANs wire together some where.

 

[sfx2000]

When in DMZ+ - just note that the DHCP server in the RG is still active for it's client subnet - let's say 192.168.1.0/24...

Put the Asus (or other ) router on the RG, assign it into DMZ+, and then on the Router (not the RG), use a different subnet, let's say 192.168.16.0/24 as an example...

The WAN interface on the Router will be within the scope of the RG's DHCP range, but traffic is handled correctly (to some degree, there are some issues there, not Asus/Netgear/etc...).

 

[septer012]

Put the Asus (or other ) router on the RG, assign it into DMZ+, and then on the Router (not the RG), use a different subnet, let's say 192.168.16.0/24 as an example...

Hi sfx2000 is there a difference between using 192.168.2.x and 192.168.16.x?

 

[sfx2000]

Hi sfx2000 is there a difference between using 192.168.2.x and 192.168.16.x?

Can use whatever is convenient - I used the 192.168.16.0/24 just as an example.

 

[LowDelay]

If you are receiving DHCP requests on a second router you have a firewall problem or you could have a wiring problem. Maybe you have the 2 LANs wire together some where.

Agree with this, as long as the RT-AC68R firewall is not forwarding DHCP requests from LAN to WAN, only other options is WiFi (which you say is off) or some other bridging of the two LANs.