Stop client from changing nstatic IP address

CommonTater said:

Yanta said:

Is it possible to stop someone changing their IP address, or setting their system to DHCP? I have ACLs defined and somone is changing their IP address to get around the rules. This only applies to one rogue person who just won't play by the rules, so I'd prefer not to make everyone suffer because of one rebel.

Eg. A registry change? Remove/Disable the network configuration?

thanks
Tanya

Tanya... There are ways in the Security Policy to prevent people from accessing certain control panel applets, etc... You could also set a deny security flag on the network control panel applet....

However... Having many times been asked to fix the carnage caused by the unchained child-mind, please let me suggest you might be further ahead addressing the source of the problem. What you risk by playing cat and mouse is that it will be seen as a challenge and the game will simply begin to escallate... which I'm pretty sure isn't what you want.

Far better I would think, to address at the "What the hell do you think you're trying to pull" level... You didn't say whether this was a work, home or school environment but in any event, confronting the bad actor is likely the only way you're going to stop it.

I agree with your thoughts, and I wish it were that simple.

This is a home issue. My son. I've confronted him several times. I'm tearing my hair out, he wont do as asked. The problem is our Internet has mb limits per month. I continually ask him to limit his downloads, and use off peak, but he refuses to listen, resulting in our allowance running out mid month and being limited to 128kbps for the rest of the month. And we have 90gigs.

I've been trying to find a way to limit http downloads, and get monitoring software that will enable me to quantify exactly what is going on, but no matter where I turn there doesn't seem to be an effective solution.

I could get tough with him, but that will only serve to push him away. I can't seem to appeal to his sense of fairness, and cooperation; a problem that is typical of many people of his generation... but I digress... sorry.

Anyway, we'll see what happens when I match mac to IP in the router...

thanks
Tanya

Yanta said:

I agree with your thoughts, and I wish it were that simple.

This is a home issue. My son. I've confronted him several times. I'm tearing my hair out, he wont do as asked. The problem is our Internet has mb limits per month. I continually ask him to limit his downloads, and use off peak, but he refuses to listen, resulting in our allowance running out mid month and being limited to 128kbps for the rest of the month. And we have 90gigs.

I've been trying to find a way to limit http downloads, and get monitoring software that will enable me to quantify exactly what is going on, but no matter where I turn there doesn't seem to be an effective solution.

I could get tough with him, but that will only serve to push him away. I can't seem to appeal to his sense of fairness, and cooperation; a problem that is typical of many people of his generation... but I digress... sorry.

Anyway, we'll see what happens when I match mac to IP in the router...

thanks
Tanya

I can certainly empathise. My own lan is pretty open, basically if you know the passwords you've got access to everything and I try to be as trusting as possible... My family is grown, the youngest is 26 (and still at home ) for the most part it's me using the equipment but the rest gather on weekends, laptops in hand, to swap pictures and "borrow" movies and such... In total there are 8 machines on this lan.

I've had problems with friends of family guesting in and making a mess of stuff. Not long ago I had to nuke a couple of accounts where my son's friends had been hacking around on his passwords... But fortunately no harm was done.

I think what I'd be prone to do in your place would be to set limits and anyone going over their limit gets to pay their own way on the downloads... Maybe if it comes out of your son's own pocket he'll get the idea...

But I can promise you this... was this going on in my family, junior would quickly discover life without access... I'd just haul right off and block his mac address at least until he paid for the overages on the account. If that didn't work, he'd see first hand just how much damage an ax can do to a computer...

You and I are different... I don't mess with people who mess with me.

I do hope you can get this solved. There's nothing worse than an unresolved family conflict...

One more thing you can try is to set DHCP reservations on your router. Most DLinks support it. The idea is that each time a given device is connected it gets the same IP from DHCP, it's keyed to the MAC number. But it also prevents issuing a reserved IP to anything but that MAC address... so DHCP would fail and he would not get a connection. With the way you have everything else locked up, he's pretty much toast at that point. (Edit: I see this has already been suggested.... )

[QUOTE=CommonTater;668824]

Yanta said:

[Editted ....]

One more thing you can try is to set DHCP reservations on your router. Most DLinks support it. The idea is that each time a given device is connected it gets the same IP from DHCP, it's keyed to the MAC number. But it also prevents issuing a reserved IP to anything but that MAC address... so DHCP would fail and he would not get a connection. With the way you have everything else locked up, he's pretty much toast at that point. (Edit: I see this has already been suggested.... )

Thanks everyone for your feedback. Sorry I haven't responded for a few days, been busy with the school holidays.

If I use the DCHP reservation, how would this go for the iPods and iPhones, I assume the same applies.

So, basically, I add a reservation for every PC, console and iPod device in the house (and I assume that also includes my Canon MX850 network attached printer), after first setting my dhcp range so that I can keep the same addresses.

Well, I'll set it up now that the kids have gone to stay with the ex for a few days and see what happens.

thanks for all your help.

Yanta said:

So, basically, I add a reservation for every PC, console and iPod device in the house (and I assume that also includes my Canon MX850 network attached printer), after first setting my dhcp range so that I can keep the same addresses.

Yep... then block all other IPs. The reservation keys to the device's MAC address so you have to have it connected when creating the reservation. Then you set everything to DHCP... Junior gets 1 address and 1 address only, no matter what he does... and you can block that if you need to.

(Read back through the thread... I can't take credit for the idea... it wasn't mine.)

WEll, I've had the dhcp reservation set up for just over a week now, and so far so good.

But I'd like to know more about the openDNS, Barman58.

I am the only one with access to the router. No one has the password, and I do not allow any one to play with it.

Can u provide a little more info, or provide some links?

thanks
Tanya

Thanks all. I have set up opendns (using the free option).
I have set up the dhcp reservations and it seems to be working well, with one exception, which appears to be related to the router, and I've followed up with D-link for that.

thanks for all your help and support.
Tanya