Re: Eero devices expose LAN to SP during reboot

[Stephen Fischer via NANOG <nanog () lists nanog org>]

I’ve got an eero mesh wireless network…in bridge mode.  Can’t see that happening in such a configuration, because the 
router/firewall  clearly blocks that sort of behavior…but nodes all do get addresses from the internal DHCP server.

Seems like that would be a relatively easy way to fix this issue

Get Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: Brandon Jackson via NANOG <nanog () lists nanog org>
Sent: Wednesday, 16 September 2026 19:45:55
To: North American Network Operators Group <nanog () lists nanog org>
Cc: Brandon Jackson <bjackson () napshome net>
Subject: Re: Eero devices expose LAN to SP during reboot

A lot of these devices actually don't even have a dedicated WAN Port, they
do some kind of detection magic and automatically pick out the WAN.

Which could partially be why this is happening, maybe it's malfunctioning
on that model and allowing a bridge.

Because it's not necessarily that uncommon these days, I'm sure plenty of
users would have issues with it due to the fact that many ISPs lock to the
first one or two MACs seen.


----------------------------------
Brandon Jackson
bjackson () napshome net

On Wed, Sep 16, 2026, 18:28 Lee Fawkes via NANOG <nanog () lists nanog org>
wrote:

> Sorry if this is a dumb question, but did you make sure the customer didn't
> plug their WAN link into a LAN port?
>
> On Wed, Sep 16, 2026, 6:19 PM Brandon Martin via NANOG <
> nanog () lists nanog org> wrote:
>
> > On 9/16/26 18:08, Majdi S. Abbas wrote:
> > >       If the access technology you're using supports it, some form
> > > of mac locking/filtering your access customers is the usual way SPs
> > > handle unwanted traffic.
> >
> > But how does one determine what MAC address to lock to?  You can't lock
> > to the first MAC you see.  That could be something random on their LAN.
> > You can't even lock to the first thing you see that sends a DHCP request
> > for the same reason.
> >
> > The only thing I can think of that would be reasonably automated is
> > trialing extremely short aging times and lease expiry times until you're
> > "reasonably confident" that the "real" router has actually shown up then
> > locking to that.  That seems...problematic.  Also hard to
> > programmatically define especially in a way that an access layer can
> > handle.
> >
> > Do people just manually purge whatever they see during initial install
> > until they're sure that the "real router" is there then statically lock
> > the port to that MAC?  Jeesh, that's messy, but I guess it's functional.
> >
> > I can keep unwanted traffic from being a network operational issue.  The
> > issue is separating the unwanted from the wanted.
> > --
> > Brandon Martin
> > Mothic Technologies
> > 317-565-1357 x7000
> > _______________________________________________
> > NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/ON4QCLSDQNEUOFXLYJPREAFIZ6BYLLJ6/
> >
> _______________________________________________
> NANOG mailing list
>
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/CVNSVIFSF56HWDF67PSS45IXNCFZJBJK/
_______________________________________________
NANOG mailing list
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/HQK7GJ5YLDLV52LWXMBW67XPL7474XA4/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/G23E64IITCOUEON3G75J5XMB7V4FSZ7Q/