Stop IP address changes on PCs

[TanyaC]

I'm trying to stop my kids changing IP addresses on their computers.

I have set DHCP reservations in my DIR-655 router. I set each machine to DHCP and the reservation assigns the correct address.

Problem is, anyone can change the adapter properties any time they want. So I if block internet access from 3am - 6am on my sons PC using an access control rule, he simply changes his IP address to something else and he's back online.

I considered changing the subnet mask to 255.255.255.224, but that gives me 32(30) addresses, but I only have 13 devices, so that would still leave some vacant addresses for them to choose from.

There are a couple of settings in the group policy editor, but they don't work. Apparently this is a known issue. In any case, all users are administrators.

Is there anyway to stop them changing IP address, or locking out changes to the LAN connection properties, Control Panel applet or any other ideas?

Thanks
Tanya

 

[Johnathan Lyman]

In any case, all users are administrators.

Make them standard users.

Either that or start "gpedit.msc" and browse to where I found the setting to prohibit access:

However unless they are standard users, they will probably still have access to gpedit and can turn it back on.

 

[TanyaC]

In any case, all users are administrators.

Make them standard users.

Either that or start "gpedit.msc" and browse to where I found the setting to prohibit access:

However unless they are standard users, they will probably still have access to gpedit and can turn it back on.

These settings do not work. I have tried it on a test PC with a standard user and my PC.

And you're right about policy editor - though at this stage I don't think they've heard of it yet. But when challenged with restrictions teenagers can be remarkable learning machines when they want to be

Setting them to standard users is also not an option, unless I want to be spending an extra 10 hours a week on the machines

What I was really hoping for was a router based solution.

I posted on dlink and the consensus seems to be that the DIR655 is too "low end" to support any real form of security settings.

 

[Johnathan Lyman]

I used to be one of those teenagers you are describing now and I can promise you we are very hard to beat. I made my way around every content monitoring/blocking software/hardware put in my way. I would get a fancier router or maybe put software on the machines to limit use (if they can't figure out how to crash it by killing the processes/services and prevent it from starting in msconfig).

 

[Everlong]

Well if he's getting around restrictions you're trying to put in, shouldn't you have a word with him?

When I was a teenager, my Mum put a timer thing on the power socket the router was plugged in to and it'd turn the power off to the router at like midnight until whatever time. Only way I could get back on was to unplug the timer. If I was found to have unplugged it, I'd get no computer use for a week.

There's also the parental controls within Windows 7 too that can limit computer usage.

 

[merkat106]

Since DHCP reservations don't seem to work on your router, I would suggest unplugging it at night or putting it on a timer.

I have a DIR-655 also, but the reservation feature does work for me. If the IP I set on the PC does not match the reservation, the PC might be able to access (in limited capacity) the network, but not the Internet. Was is the hardware revision for your DIR-655? It says on the bottom of the unit. Upgrading with firmware from the US D-Link website might help.

Also, consider a /28 mask. That should give you about 14 addresses. (255.255.255.240)

 

[logicearth]

You should be using MAC addresses to identify computers not IPs.
Windows 7 does not currently support changing MAC addresses.

 

[Ivan the SoSo]

Put the router in your bedroom....unplug when you go to bed....

 

[WebMattR]

Speaking as someone who went so far as to change the time in BIOS to allow myself more time on the computer, I can second the remark that we're hard to stop.

I see three viable solutions.* Firstly, and perhaps best, is to talk to your kids about it, and make sure they understand the rules. Also, don't just tell them the rules, make them repeat them back to you, and tell you the consequences you've instated will be. It helps ensure that they truly listen, and don't just glaze over during the conversation. Secondly, is to use mac-based filtration and limitation, rather than IP based. Also, change the defauly password on the router (if you haven't already) and find a way to tape/cover over the reset button that doesn't permanently disable it. Lastly, if all else fails, would be take the power brick to bed with you, and leave it on your night stand, with the policy that when you go to bed, the internet goes off. If they truly want it back at that point, make them earn it by demonstrating an ability to be responsible.



*please note: I'm not, in any of the following, suggesting you raise your kid differently than you choose to. I'm just giving my input, and hoping it helps with your situation.

 

[Kari]

You should be using MAC addresses to identify computers not IPs.
Windows 7 does not currently support changing MAC addresses.

Solved

 

[TanyaC]

Since DHCP reservations don't seem to work on your router, I would suggest unplugging it at night or putting it on a timer.

I have a DIR-655 also, but the reservation feature does work for me. If the IP I set on the PC does not match the reservation, the PC might be able to access (in limited capacity) the network, but not the Internet. Was is the hardware revision for your DIR-655? It says on the bottom of the unit. Upgrading with firmware from the US D-Link website might help.

Also, consider a /28 mask. That should give you about 14 addresses. (255.255.255.240)

The DIR655 is brand new (old one replaced under warranty). The hardware revision is A4 and it's on firmware 1.30WW (As shipped). I installed 1.34WW on the old one when I was trouble shooting it, but that didn't solve this problem.

I suspect the router is working as it is supposed to, assuming I've configured it correctly.

I have set up the DHCP reservations for each machine in the router.

I have not configured any network filters because everytime I do it kills internet access for everyone and I have to reset router to factory defaults to get back into it. (see attached screen shots).

When a PC is set to use DHCP it will pick up the reserved address.

When a PC is configured with an IP address it will connect to the internet, regardless of the DHCP reservation.

There are five IPs not listed in the pics. 192.168.1.1 is the file/web server, 192.168.1.4 is currently turned off for repairs. The printer is 192.168.1.31

There are also two IPhones that are occasionally used. So /28 won't be enough addresses. But thanks for the suggestion.

 

[TanyaC]

You should be using MAC addresses to identify computers not IPs.
Windows 7 does not currently support changing MAC addresses.

Solved

Seriously - What!?

 

[SledgeDG]

I would still go with the router in a slightly different approach:

Simply allow certain IP addresses to connect with the restrictions you want to enforce and only those IPs
Kind of like a white list which means if they want to be smart a**es and change the IP they're automatically locked out.
(you might want to change and keep to yourself the router-PW That's how it works for my brats
PLUS as a bit of "positive reinforcement" I told 'em "If I catch you even trying to circumvent my restrictions you're grounded from Facebook for AS LONG AS I SEE FIT"
If nothing else works scares them...that does it

-DG

 

[WebMattR]

Seriously - What!?

He's saying that, rather than using the DHCP functionality of the device, apply a mac filter (when you click the mac filter on, add your machine you're using before you click "apply" or you'll be locked out), and then individually add each machine explicitly, and use that as a limiter. Also, have you tried the securespot 2.0 that is an optional add-on software for the DIR-655? If that doesn't do it, I'd say investigate Sledge's solution, of creating a restricted white list.

Oh, and what about using a /27 subnet mask? It'd limit you to 30 useable IP addresses.

I maintain my previous solution is the best way to go, but it's your call.

 

[Kari]

You should be using MAC addresses to identify computers not IPs.
Windows 7 does not currently support changing MAC addresses.

Solved

Seriously - What!?

Using MAC addresses your kids can change the IP as often as they want to. If they can not change your router settings i.e. they don't have credentials to router, they can not change MAC filtering rules.

Kari

 

[Johnathan Lyman]

Solved

Seriously - What!?

Using MAC addresses your kids can change the IP as often as they want to. If they can not change your router settings i.e. they don't have credentials to router, they can not change MAC filtering rules.

Kari

Then it just comes down to if the kids are smart enough to spoof their MAC addresses or borrow USB wireless adapters from friends or get their own.

 

[Kari]

Then it just comes down to if the kids are smart enough to spoof their MAC addresses or borrow USB wireless adapters from friends or get their own.

1) Every NIC, wireless or wired, has its own MAC address. If MAC address filtering is enabled, only NIC's listed can access the net.

2) Windows does not allow changing of MAC address.

Kari

 

[TanyaC]

Then it just comes down to if the kids are smart enough to spoof their MAC addresses or borrow USB wireless adapters from friends or get their own.

1) Every NIC, wireless or wired, has its own MAC address. If MAC address filtering is enabled, only NIC's listed can access the net.

2) Windows does not allow changing of MAC address.

Kari

Thanks to all who have replied.

DOH!!!! The problem is in the ACL... The DIR-655 allows me to specify an IP address or a MAC address... the penny has dropped now

I have set up the network filters, and left the DHCP reservations intact.

Let's see how that goes..

thanks
tanya

 

[Johnathan Lyman]

Then it just comes down to if the kids are smart enough to spoof their MAC addresses or borrow USB wireless adapters from friends or get their own.

1) Every NIC, wireless or wired, has its own MAC address. If MAC address filtering is enabled, only NIC's listed can access the net.

2) Windows does not allow changing of MAC address.

Kari

How to spoof a MAC address | TechRepublic

All they'd need to do is mimic the mac address of say an adult's computer that may not have restrictions on the router.

 

[TanyaC]

How to spoof a MAC address | TechRepublic

All they'd need to do is mimic the mac address of say an adult's computer that may not have restrictions on the router.

Obviously I don't understand this stuff.. but it seems pointless sticking a MAC address in the registry so it can be easily spoofed. At what point is the physical NIC MAC address queried? Never?

What would happen if two computers shared the same MAC address and tried to access the internet at the same time? Would you get a MAC address conflict like you do with IP addresses?

All computer share the same web and port filters, including mine, so it would be pointless using any other computer. All I am talking about is completely blocking access when they misbehave. So he could simply use someone elses computer when the rest of are not home.