Scenario: I have a Raspberry Pi 5 (Raspbian Trixie, Linux 6.18) running a Wifi AP with clients on their own 10.10.3.x subnet, DHCP-served with [static] addresses from the Pi. The Wifi AP is driven by hostapd and created as a bridge under systemd-networkd in order that everyone gets access to everything. The Pi is connected to my main LAN via Ethernet on a 10.10.2.x address which is statically allocated by the main router on the LAN and the Ethernet port on which the Pi joins the main router is firewall protected.
My problem is that, with the bridge arrangement on the Pi, its DHCP server sees not only the DHCP requests from the Wifi clients but also sees any DHCP requests on the main network via eth0, and serves them [a 10.10.3.x address], which is causing some chaos. I’ve tried ebtables and iptables (to block DHCP traffic coming in from eth0, but not all DHCP traffic as the Pi needs to be able to obtain its own static address for eth0), I’ve tried using dnsmasq or isc-dhcp-server (to bind to specific interfaces) instead of systemd-networkd‘s built-in DHCP server but nothing works: DHCP requests seem to get into the bridge from eth0 without passing through ebtables or iptables, so they hit the bridge and, once in the bridge, no-one can tell where they came from in order to serve wlan0 differently to eth0.
It has been suggested that I don’t have a bridge and instead NAT Wifi stuff across to eth0, but then I lose flexibility ‘cos, as far as the main router is concerned, everything attached to the Pi is coming from the Pi’s IP address. I would have no way of letting a particular Wifi-attached device out to the internet if I wanted to. OK, I don’t currently need this but I can see that it would be a useful thing to do for the future.
Is there a way to keep the bridge and stop it serving everyone their DHCP requests?
