2

I have a network with a DHCP server and RADIUS authentication.

Clients connect to my network, get a DHCP address, enter the signing in page, input their prepaid cards, and get to the Internet.

We sometimes see some clients (was once malicious) connect a router to one of my Access Points and they don't disable DHCP functionality on that router... The entire network falls apart, until we disconnect that actor or re-configure his router correctly to disable DHCP, and allow that router to take a DHCP lease from the main DHCP server we control.

So How do I force my network to only honor the DHCP server I control?

In fact, the whole problem I see now is a packet loop. I'm assuming it's someone who's connected a wrongly configured router with DHCP enabled. So I'm trying to disallow anyone from assuming DHCP role.

DHCP Server is at 192.168.1.5 (RouterBoard device)

Network Diagram

Improve this question

2 Answers 2

Reset to default
0

You can't prevent someone from activating DHCP, but you can set up your RouterBoard with 'Rogue DHCP Detection', and either alert you when that occurs, or (with additional scripting / automation) programmatically block their switch port or Wifi access.

On your DHCP server, the alert would look like:

00:34:23 dhcp,critical,error,warning,info,debug dhcp alert on Public:
    discovered unknown dhcp server, mac 00:02:29:60:36:E7, ip 10.5.8.236

See http://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Server for more details.

Improve this answer
2
  • Thanks, I added an Alert. Nothing seem to come up. Also, How do I block them? Note that most likely they'll be connected to one of my NanoStation M2 devices at the edge of the network.
    – Questioner
    Dec 10, 2016 at 0:07
  • There's nothing canned that will do that. You'd have to have some sort of script that takes that information and configures your nanostations to block that MAC. That'll knock the node off your network entirely.
    – Jason Martin
    Dec 10, 2016 at 2:57
2

Did you try DHCP snooping

DHCP snooping is a layer 2 security technology built into the operating system of a capable network switch that drops DHCP traffic determined to be unacceptable. The fundamental use case for DHCP snooping is to prevent unauthorized (rogue) DHCP servers offering IP addresses to DHCP clients. Source

although looks like your gear may not support it, so the reactive approach might be your only option.

Improve this answer
1
  • As already mentioned: Cisco switches allow for so-called "DHCP snooping": It is possible to specify trusted and untrusted ports. The trusted port should be the port where the DHCP server is connected to. The switch does not allow any DHCP responses (offer, ack) on untrusted ports.
    – Arani
    Dec 2, 2019 at 11:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .