0

I need to add a static route to my internet service provider's router. Unfortunately, this router does not provide such a modification option for an end-user.

The reason I need the static route is so that clients in that LAN will know where to send packets for a remote LAN which is connected via wireguard.

So my solution was to setup a second DHCP server on the Raspberry Pi that is providing the wireguard tunnel. I make the DHCP server non-authorative and add some hard coded MAC addresses to the configuration so it will only give out IPs for those clients.

Now, if a client get's its IP from this second DHCP server it can also get the default gateway from it. I can set this up for the DHCP server.

Would it be correct to set this Raspberry Pi as default gateway instead of the ISPs router? (This will only affect clients that get the DHCP from the Pi.)

I could then add a route for the specific remote LAN into the wireguard tunnel. And the default route will go to the internet service provider which is the gateway for the internet.

Will that work?

Improve this question
5
  • 2
    Can you switch off DHCP entirely on the ISP-provided device? That would seem to me to be your best solution in the circumstances, and then have a proper DHCP service that provides correct routing information Commented Oct 31, 2022 at 9:32
  • 2
    Ideally, to have two DHCP servers in the same network segment, those DHCP servers need to have been programmed to update client state information with each other and otherwise cooperate. If you have to have two non-cooperating DHCP servers, you will need to resort to kludges like splitting your address range into two non-overlapping pieces and have each DHCP server be responsible of its own piece, and have both DHCP server otherwise configured the same... but that is not applicable to your situation. I'd recommend roaima's suggestion of switching off the DHCP server of the ISP-provided device. Commented Oct 31, 2022 at 13:22
  • "Would it be a solid solution to give the Pi as gateway to the devices and on the Pi itself use the main router as its gateway?" You'd need to NAT all connections going through the Pi. You would also half the available bandwidth unless you've two interfaces on your particular version of a Pi. I would recommend instead advertising to your clients a default route via your ISP and the specific route through the Pi Commented Oct 31, 2022 at 13:57
  • If you insist on having the Pi accept all traffic you'll half the bandwidth. If you solve the problem correctly, as two of us have already advised, you will only use the Pi for the traffic destined for its static route and the remainder will be able to go directly to the ISP's router Commented Oct 31, 2022 at 14:44
  • Yes of course. That's why it's being recommended Commented Oct 31, 2022 at 17:58

1 Answer 1

Reset to default
0

The comments to my question suggest to disable the first DHCP server which is proably a valid thing to do. However, I do not seem to have any troubles so far running two servers, because the second one is non-authorative and the ranges are separated. He seems to hand out two IPs so far to my two test clients. (I might edit my answer if I recognise issues.)

Also: Switching my ISP router's local DHCPv4 server to off just seems to turn it non-authorative since I still can edit static IPs for MAC addresses in the GUI after switching off. So local seems to stand for "the locally responsible".

Even in the case I could disable the first DHCP server I still would face this:

My clients did not receive a route to the tunnel from my own DHCP server. This can be accomplished by configuring the DHCP server to hand out static routes.

Caution: It will then not hand out the default gateway any more, unless you define it as another static route: https://ral-arturo.org/2018/09/12/dhcp-static-route.html

So the solution to my problem is not to setup a second (default) gateway, but to configure DHCP so it will hand out the routes that my clients need.

My /etc/dhcp/dhcpd.conf looks like this:

#authoritative;
default-lease-time 86400;
max-lease-time 86400;
option rfc3442-classless-static-routes code 121 = array of integer 8;
option ms-classless-static-routes code 249 = array of integer 8;

subnet 192.168.111.0 netmask 255.255.255.0 {
  range 192.168.111.223 192.168.111.254;
  option routers 192.168.111.1;
  #deny unkown-clients;
  option domain-name-servers 192.168.111.1;
  option domain-name "local";
  option rfc3442-classless-static-routes 24, 192, 168, 1, 192, 168, 111, 222;
  option ms-classless-static-routes 24, 192, 168, 1, 192, 168, 111, 222;
}

host squeezeboxtest {
  hardware ethernet 00:04:20:5f:55:8e;
  fixed-address 192.168.111.231;
  option host-name "squeezeboxtest";
}

host asusklein {
  hardware ethernet 04:e6:76:5d:cf:a6;
  fixed-address 192.168.111.232;
  option host-name "asusklein";
}

host HAPZE {
  hardware ethernet fc:f1:52:fc:a6:60;
  fixed-address 192.168.111.21;
  option host-name "Sony HAP-ZE";
}

The server can be restarted with

sudo systemctl restart isc-dhcp-server

Just as a note: It is possible to restrict clients from getting an IP from the second DHCP server by adding the line deny unkown-clients;.

Improve this answer
3
  • There are DHCP options that allow specification of more complex routes than just the default gateway, but not all clients will support or even request for those. It seems your needs go beyond what the ISP-provided router can do, so you should consider getting a more flexible router that you will be able to fully control. It would allow you to set up your VPN connection in a much more straightforward fashion: essentially just configuring the router to to decide what goes to the VPN tunnel and what goes directly to ISP. The clients would just use their default gateway all the time. Commented Nov 4, 2022 at 1:14
  • Also, if the ISP-provided router is a typical cheap one, switching it into bridge-only mode and disabling all non-essential functionality would free up some of its processing capacity to its main job (possibly resulting in better reliability), while your new router would handle the actual routing (and NAT if necessary).You would have internet -> ISP router in bridging mode -> your new router -> your own network. Commented Nov 4, 2022 at 1:23
  • Thank you very much for your input. My ISP router has a formidable Wifi6 and thus I don't want to bridge it (and lose the wifi). Also, I want to accomplish everything with the hardware I already use. It works very reliable so far, the clients I picket out to be served fro the second DHCP get the default route and the special route from the second DHCP server. Commented Nov 5, 2022 at 10:32

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.