Stop IP address changes on PCs

TanyaC · 11 Feb 2011

merkat106 said:

Since DHCP reservations don't seem to work on your router, I would suggest unplugging it at night or putting it on a timer.

I have a DIR-655 also, but the reservation feature does work for me. If the IP I set on the PC does not match the reservation, the PC might be able to access (in limited capacity) the network, but not the Internet. Was is the hardware revision for your DIR-655? It says on the bottom of the unit. Upgrading with firmware from the US D-Link website might help.

Also, consider a /28 mask. That should give you about 14 addresses. (255.255.255.240)

The DIR655 is brand new (old one replaced under warranty). The hardware revision is A4 and it's on firmware 1.30WW (As shipped). I installed 1.34WW on the old one when I was trouble shooting it, but that didn't solve this problem.

I suspect the router is working as it is supposed to, assuming I've configured it correctly.

I have set up the DHCP reservations for each machine in the router.

I have not configured any network filters because everytime I do it kills internet access for everyone and I have to reset router to factory defaults to get back into it. (see attached screen shots).

When a PC is set to use DHCP it will pick up the reserved address.

When a PC is configured with an IP address it will connect to the internet, regardless of the DHCP reservation.

There are five IPs not listed in the pics. 192.168.1.1 is the file/web server, 192.168.1.4 is currently turned off for repairs. The printer is 192.168.1.31

There are also two IPhones that are occasionally used. So /28 won't be enough addresses. But thanks for the suggestion.

TanyaC · 11 Feb 2011

Kari said:

logicearth said:

You should be using MAC addresses to identify computers not IPs.
Windows 7 does not currently support changing MAC addresses.

Solved :)

Seriously - What!?

SledgeDG · 11 Feb 2011

I would still go with the router in a slightly different approach:

Simply allow certain IP addresses to connect with the restrictions you want to enforce and only those IPs
Kind of like a white list which means if they want to be smart a**es and change the IP they're automatically locked out.
(you might want to change and keep to yourself the router-PW

That's how it works for my brats

PLUS as a bit of "positive reinforcement" I told 'em "If I catch you even trying to circumvent my restrictions you're grounded from Facebook for AS LONG AS I SEE FIT"
If nothing else ~~works~~ scares them...that does it

-DG

WebMattR · 11 Feb 2011

Tanyam said:

Seriously - What!?

He's saying that, rather than using the DHCP functionality of the device, apply a mac filter (when you click the mac filter on, add your machine you're using before you click "apply" or you'll be locked out), and then individually add each machine explicitly, and use that as a limiter. Also, have you tried the securespot 2.0 that is an optional add-on software for the DIR-655? If that doesn't do it, I'd say investigate Sledge's solution, of creating a restricted white list.

Oh, and what about using a /27 subnet mask? It'd limit you to 30 useable IP addresses.

I maintain my previous solution is the best way to go, but it's your call.

Kari · 11 Feb 2011

Tanyam said:

Kari said:

logicearth said:

You should be using MAC addresses to identify computers not IPs.
Windows 7 does not currently support changing MAC addresses.

Solved :)

Seriously - What!?

Using MAC addresses your kids can change the IP as often as they want to. If they can not change your router settings i.e. they don't have credentials to router, they can not change MAC filtering rules.

Kari

Johnathan Lyman · 12 Feb 2011

Kari said:

Tanyam said:

Kari said:

Solved :)

Seriously - What!?

Using MAC addresses your kids can change the IP as often as they want to. If they can not change your router settings i.e. they don't have credentials to router, they can not change MAC filtering rules.

Kari

Then it just comes down to if the kids are smart enough to spoof their MAC addresses or borrow USB wireless adapters from friends or get their own.

Kari · 12 Feb 2011

Johnathan Lyman said:

Then it just comes down to if the kids are smart enough to spoof their MAC addresses or borrow USB wireless adapters from friends or get their own.

1) Every NIC, wireless or wired, has its own MAC address. If MAC address filtering is enabled, only NIC's listed can access the net.

2) Windows does not allow changing of MAC address.

Kari

TanyaC · 12 Feb 2011

Kari said:

Johnathan Lyman said:

Then it just comes down to if the kids are smart enough to spoof their MAC addresses or borrow USB wireless adapters from friends or get their own.

1) Every NIC, wireless or wired, has its own MAC address. If MAC address filtering is enabled, only NIC's listed can access the net.

2) Windows does not allow changing of MAC address.

Kari

Thanks to all who have replied.

DOH!!!! The problem is in the ACL... The DIR-655 allows me to specify an IP address or a MAC address... the penny has dropped now

I have set up the network filters, and left the DHCP reservations intact.

Let's see how that goes..

thanks
tanya

Johnathan Lyman · 12 Feb 2011

Kari said:

Johnathan Lyman said:

Then it just comes down to if the kids are smart enough to spoof their MAC addresses or borrow USB wireless adapters from friends or get their own.

1) Every NIC, wireless or wired, has its own MAC address. If MAC address filtering is enabled, only NIC's listed can access the net.

2) Windows does not allow changing of MAC address.

Kari

How to spoof a MAC address | TechRepublic

All they'd need to do is mimic the mac address of say an adult's computer that may not have restrictions on the router.

TanyaC · 12 Feb 2011

Johnathan Lyman said:

How to spoof a MAC address | TechRepublic

All they'd need to do is mimic the mac address of say an adult's computer that may not have restrictions on the router.

Obviously I don't understand this stuff.. but it seems pointless sticking a MAC address in the registry so it can be easily spoofed. At what point is the physical NIC MAC address queried? Never?

What would happen if two computers shared the same MAC address and tried to access the internet at the same time? Would you get a MAC address conflict like you do with IP addresses?

All computer share the same web and port filters, including mine, so it would be pointless using any other computer. All I am talking about is completely blocking access when they misbehave. So he could simply use someone elses computer when the rest of are not home.