Problem with randomized MAC address on cellphone

[pankaj]

Hi,
I have a Orbi router connected to a L2 switch and Orbi is running in AP mode so all DHCP assignments for wireless clients are done via OPNSense. On both Android and iPhone there is an option under WiFi to use phone MAC or a randomized MAC, I understand that the latter is more secure.

There are no host specific rules on WiFi VLAN and for now I have allowed pass everything to keep things simple. It works fine when I use phone MAC address but when I switch to randomize MAC on cellphone, the device gets the correct IP assignment (with WiFi VLAN subnet) but does not get internet access.

Is there an explanation for this behavior?

[NajibHassan]

got the same problem with opnsense, pfsense no problem for me. using TPRE450 as AP mode

[schnipp]

On both Android and iPhone there is an option under WiFi to use phone MAC or a randomized MAC, I understand that the latter is more secure.

Randomized MAC has nothing to do with security it's only related to privacy. So, there is no need, to use randmomized MACs in your private network.

It works fine when I use phone MAC address but when I switch to randomize MAC on cellphone, the device gets the correct IP assignment (with WiFi VLAN subnet) but does not get internet access.

I recommend a packet dump of both scenarios and to check the difference.

[the-mk]

is "Enable Static ARP entries" active in the DHCP settings? (help of that settings says: This option persists even if DHCP server is disabled. Only the machines listed below will be able to communicate with the firewall on this NIC.)

[Patrick M. Hausen]

As far as privacy is concerned: randomised MAC addresses are not necessary for IPv6 privacy. Privacy extensions should take care of that. Randomised MACs are intended to protect against malicious access points that track their users across APs and locations.

[fabian]

Randomised MACs are intended to protect against malicious access points that track their users across APs and locations.

Exactly. That is used against all kinds of position tracking by ad tech.

You can open the white paper on that page to view the PDF.
https://meraki.cisco.com/solutions/location-analytics

The MAC address is only randomized while scanning for SSIDs. When you connect to one, the MAC will not change. It can then be the original MAC address or it stays at the same random one.

[RamSense]

Dear PankaJ,

I have noticed this also! I have opnsense configured with:
Deny unknown clients - on
Ignore Client UIDs - on
Static ARP - on

All devices are in the "DHCP Static Mappings for this interface."  list.

When my devices update, like iPhone, appletv, MacBook, iot, etc, all keeps working fine BUT when my son updates his e.g. his iPhone to a beta version of iOS that iPhone connects to wifi but gets no data/internet.
I have to delete his iPhone and connect it again with static ip. It looks like the same problem you are experiencing. Is this a bug in opnsense or in my understanding how my "closed network settings" work?

[franco]

I think this is how you can effectively block the MAC randomisation from being used...


Cheers,
Franco