Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am running DHCP on server 2008 R2 on my virtual setup, but when i go out on the network with others i see that i give unwanted users DHCP adresses. How can I prevent that so only my clients get served?

edit: updated and thanks

share|improve this question
Are you saying that "internet" clients are getting DHCP addresses from your server? I don't see how that's possible. – joeqwerty May 11 '10 at 22:40
Exactly how are you seeing that it's giving IP addresses to unwanted users? Perhaps you can give us some insight into how you have this system set up. Is it on a VPS? If so, why is it even running a DHCP service? – John Gardeniers May 11 '10 at 22:47
Update to 2012, enable DHCP guard where you need to. Altenratively filter DHCP request on your back end switch where appropriate. – TomTom Aug 13 '12 at 4:56

5 Answers 5

up vote 4 down vote accepted

Use DHCP reservations for those computers that you want served.

Furthermore, your scenario doesn't make a whole lot of sense. Could you add more info? Is your Server 2008 machine a VM? I don't see how going onto the internet would cause reservations to show up in your DHCP server. DHCP servers can only service the subnet that they are on, unless there are DHCP helpers on the network.

share|improve this answer
This does nothing to prevent mac spoofing. – gravyface May 12 '10 at 2:50

I'll speculate that you have a VM network that you are feeding from your host with DHCP. You've bridged that network onto your local area network, and now your VM host is serving DHCP to unsuspecting neighbour computers, earning you the well deserved(1) ire of your network/sysadmin, right?

With VMware, the solution is to set up the VMs as being "NAT" clients. This will set up a private network for the VMs, but will act as a gateway so that those VMs can interact with the rest of the network.

Alternatively, you can set up your VMs to be on a "bridged" network, and instead of using your VMware-provided DHCP server you then use the LAN's DHCP server. Your VMs then behave like any other node connected to the LAN.

(1) I've been the unhappy sysadmin who is out looking for rogue DHCP servers. When VP-Finance can't do some presentation because his laptop is bound to some VM server somewhere, I get to go around the floor with a hammer looking for things to turn off. With all due respect, when your tools can have an enormous negative effect on your LAN neighbors, you better know what you are doing BEFORE you turn them on.

share|improve this answer
+1 "you better know what you are doing BEFORE you turn them on" - Oh the problems that could be solved just by people following this advice. – Chris S May 12 '10 at 2:14

In 2008R2, you use ALLOW filter enabled to restrict to only devices you want on your network. Only devices you enter into ALLOW will get an address. Because ALLOW uses MACs, what I do is get a clean roster of computers (and BYODs), Select ALL, then add to ALLOW filter. I then enabled the filter, and that is the end of rogue devices. The business of rogue DHCP servers is a bit more puzzling. I disagree that computers can become DHCP servers. My gateway went down today, and we found only a computer using AOL could get Internet. The Gateway is listed as, and the DHCP IP is on its own scheme, but similar to the scope we use. But only AOL works. No other browser does. Figure that one out.

share|improve this answer

Reserve IP addresses to specific MAC addresses you want to get IP addresses.

I'm assuming from your description that you have a network where internally and visible to your VM you have specific machines you want to serve DHCP information to? In that case the only choice is to reserve IP addresses unless you want to configure machines with their own static configurations.

If you have a limited number of specific machines to deal with, you'd probably be better off doing it with static configurations and drop the DHCP altogether.

I hope you don't have two DHCP servers on this network in the first place...yes? Like, one that someone has the network for everyone and one that you're playing with in a VM? Otherwise you're asking for problems...

share|improve this answer

To do this right, you're going to want to exert some control at layer 2 using 802.1x for port authentication: if I don't know who you are, or you're not authorized, your device is getting shut down; no DHCP, no static IP, no layer 3 period.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.