Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I have a MikroTik router (that has firewall and scripting capabilities) that is acting as a DHCP server for the 192.168.1.0/24 subnet. Is there any way I can stop it from passing traffic from a user who has statically assigned himself an address within that range? If so, what is it called so that I can google how to implement it? Do I have to create a script that dynamically modifies firewall rules to match DHCP leases?

My end goal shown as an example in case my question is not clear enough: A user gives themselves the address of 192.168.1.2. My router sees that this is not in his DHCP lease table. He drops all traffic from 192.168.1.2.

share|improve this question
4  
He's not spoofing, but statically assigning. You want a MAC-based access control, but it is possible to spoof MAC addresses. You might be able to script a process where the MACs of the DCHP clients are passed to the firewall. – schroeder Aug 21 '12 at 23:28
That's right, your network card and router would need to support authentication with encryption to actually handle something like that. Otherwise it's not resilient to anyone because it's easy to spoof MAC. Also, Captive Portal can help by asking username and password no matter ip or mac address. – Andrew Smith Aug 21 '12 at 23:38
2  
Can you explain the reason you think you need to do this? This is a very unusual requirement and most of the time, when people think they have unusual requirements, it's because they've got their requirements wrong. (For example, a much more simple change elsewhere may eliminate this perceived requirement.) – David Schwartz Aug 22 '12 at 0:25
Stopping static IPs is certainly a reasonable goal in some non-security contexts. For example to prevent accidental IP collisions at LAN parties. – CodesInChaos Aug 22 '12 at 6:59

4 Answers

up vote 2 down vote

No, what you are asking is fundamentally not possible. The primary function of the MAC address sublayer is allow for the communication of numerous devices(OSI Layer 2) via a physical medium (OSI Layer 1). Nothing is preventing an attacker from assigning their NIC an arbitrary MAC address value. One side effect is that your DHCP server will then issue the same IP address to the same MAC for each request, even if the request originates from an attacker's machine. This is not to be confused with ARP spoofing, which is useful for MITM attacks, and can be prevented.

Really what you are looking for is a VPN. This can be used to allow only trusted hosts to communicate.

share|improve this answer
The VPN is secondary. What he's really looking for is IPsec, which a VPN usually provides. – Polynomial Aug 22 '12 at 7:29
1  
@Polynomial You are correct sir. However the OP will probably end up using a VPN. – Rook Aug 23 '12 at 3:16
Indeed. Though if he can enable IPsec on his network (which most commercial-grade routers will allow) it'd save the VPN. – Polynomial Aug 23 '12 at 5:51
up vote 1 down vote

It sounds as though you want to make sure unauthorized clients are not permitted onto the network. If this is the case, see the Network Security section below. If you are primarily looking to avoid conflicts and force users to use the DHCP server, read the Network Availability section below.

Network Availability

  • As the previous answer by Rook pointed out, what you're specifically asking for can be subverted in many ways. If you are just concerned about users setting their own IP address and creating network conflicts with your DHCP assigned address, the MicroTik DHCP server already checks to see whether or not the address is available before assigning a lease. This may require some additional configuration and your mileage may vary

Network Security

  • A solution controlling network access and allowing network access to only those who are authorized on the network would be Network Access Control. The protocol for this is 802.1x. Cisco has a product called Clean Access Agent that works around a router's ability to perform 802.1x authentication directly.
share|improve this answer
up vote 0 down vote

You could probably do access control at a higher level or implement a NAC like concept of something like 802.1x. If you are on a purely switched network you can disable the port until they authenticate. You could also force all traffic on a VPN as stated above or you can force traffic through a proxy with TLS/SSL/etc with authentication to keep the rogue off the network.

  1. http://en.wikipedia.org/wiki/802.1x
  2. http://en.wikipedia.org/wiki/Network_Access_Control
  3. http://en.wikipedia.org/wiki/Network_Admission_Control

The root question here, is why can someone physically connect to your network if they are not authorized?

share|improve this answer
up vote 0 down vote

Thank you all for the thoughtful responses. I see now that there is no all-purpose solution for what I was seeking (since 802.1X is impractical for my network, since I'm an ISP) and for a more complete answer I would have to provide more details about my network.

Fortunately, I found the answer I was looking for accidentally while browsing the MikroTik DHCP server options. I can stop someone from spoofing their IP address and accessing the gateway by using the "Add-ARP" option as discussed in this forum post. This would guarantee that a user would have to enter into communication with my gateway.

But what about MAC Address spoofing? In my (admittedly, unorthodox) network, we have MAC address authentication for DHCP, but ACLs guarantee that users are isolated and can only speak with the gateway and MAC Addresses of users are associated to a certain port. In other words, if a user is detected on a new port other than the one that they are originally associated with (which is super unlikely to be legitimate), they are not authenticated.

I have not accepted this as my final answer yet, because I want to know if there's something I've missed or if this answer requires clarification.

share|improve this answer
In this scheme, your number of users is limited to number of ports of MikroTik router. Also, you need to protect the broadcast and multicast addresses. – Andrew Smith Aug 23 '12 at 22:44
I understand your second point and will keep this in mind, but I'm a little confused about your second. Are you saying that I'm limited to one user per port because the filtering system breaks down? In this case, I have customer end devices that I control that will let me isolate each individual subscriber. – Seanny123 Aug 24 '12 at 23:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.