A typical problem on networks is that someone setup a DHCP server by mistake, and the entire network goes down.

Is it possible in VMware to close for port 68 UDP for all clients?

That would ensure that no VM would be able to act as a DHCP server.

| improve this question | | | | |
  • A couple of things: 1. I don't think the problem is as common as you think it is. 2. The entire network going down as a result is highly improbable. 3. How would a DHCP server exists in the first place if you didn't install and configure it? 4. Can you cite examples or data supporting your statements (in the first paragraph of your question)? – joeqwerty Dec 1 '11 at 13:41
  • It's quite common on real machines. It happens when someone installs a DHCP server for a certain use and forgets to turn it off when moving/switching networks. However, thats not very likely on a VM. – user606723 Dec 1 '11 at 15:14
  • I tend to lean more towards joeqwerty's response - this is an administrative issue, not a technological issue. If you have multiple DHCP servers running on the same subnet, there's a good chance that your network configuration is, um, less-than-optimal. :) – Avery Payne Dec 1 '11 at 22:17
  • @user606723: I've worked in a lot of environments and I've never seen this scenario. I'm not saying that it doesn't happen but I am saying that I don't think it's very prevalent. In addition, a rogue DHCP server may inhibit and/or disrupt network communication but I highly doubt it will "bring the entire network down". That statement implies that all network communication/operations cease for all nodes, which I think is highly improbable. – joeqwerty Dec 2 '11 at 4:27
  • @Avery: I hate to disagree with you again but I would argue that having mutliple DHCP servers on the same subnet is a fairly common practice in order to achieve split-scope load balancing. In fact, W2K8R2 has a DHCP wizard for just this purpose. – joeqwerty Dec 2 '11 at 4:29

Perhaps VMware vShield can do this.. I'm not sure. The built in vSwitches can not filter traffic.

Either way - security measures like these are usually put in place at the edge network. Cisco switches can for example use DHCP snooping to filter and/or rate limit DHCP offers from untrusted switch ports. This implicates that you do not run your DHCP server on the same vmware hosts as the vm's you are trying to block.

| improve this answer | | | | |
  • Good call on vShield - I wouldn't put it past VMware to sell something that might do this, but as you point out, it doesn't mean it's the right tool for the job. – growse Dec 1 '11 at 12:40

I don't think so - I don't believe the vswitches have any packet filtering capability. Sounds like you might need to segregate and firewall your VM network from networks you don't have control over.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.