Home / server / Questions / 364350
Accepted
bakytn
Asked: 2012-02-28 19:41:57 +0800 CST

Securing the network: IP conflicts and its solutions

  • 772

Today I found out that I don't know how to fix IP conflicts.

Say you have a server with IP1

another machine connects and assigns itself IP1.

How do people usually prevent this? How they(you) resolve?

I heard that usually it is secured by ROUTER. Is that correct?

And it is the only way?

UPDATE:

My question was about the situations when some user just assigns server IP to itself and that would cause problems.

But I found out that system administrators just should control all the hosts and machines and never allow users to assign any IP but given by Admin (read as given by DHCP server)

linux networking security

6 Answers

  1. One way to do it is to assign each server its own vlan. Any IP ranges that the server should have access to are assigned to that vlan. They are not permitted to use any IP that falls outside those ranges (the router simply won't route it to them).

    The other option is to statically route all traffic for a certain IP to a certain MAC address. This isn't great, as there's a brief period where if the server gets rebooted another client can claim the MAC address.

    • 1
  2. Best Answer

    If you had a DHCP server on your network, it would manage a range of IP adresses and assign new clients one of them, making sure no two clients use the same IP at the same time.

    Some hardware routers already include a DHCP server (particularly those for home-use) and several Linux distributions include a DHCP server role. Of course clients would have to be configured to use the DHCP server instead of having fixed IP addresses or assinging themselves one (as Windows does when it can't get one via DHCP).

    • 1

  3. If you are manually assigning IP addresses for devices that are on the same network, it is up to you to ensure they do not conflict.

    The usual route is as @PersonalNexus says - DHCP - which can auto-assign them in such a way that you do not get conflicts. This is the simplest for a large network, in fact for very large networks it is the only practical solution.

    An alternative, which is very messy (and one I would not recommend), is to have each device on a separate network (and actually run networks to each patch point) - this, however, requires you to set up the router/switch to cope with multiple LANs or VLANs using the same network space so requiring every one to be NAT'ed. If you are haven't had experience managing network conflicts I would suggest configuring a switch to do this may be exceptionally difficult.

    • 1

  4. There is no real way to block users from assigning themselfs IPs by random ( = risk a colliding IP) but to restrict them from assigning the IPs themself - aka by the admin's own hand or by DHCP.

    If the network is a little larger it might be a good idea to seperate into client and server vlans with some routing (L3-Switch) in between - so at least the precious servers are safe from these coliding IPs. - but no need for a vlan for each server - just one vlan where only the admin can change things and no user has physical access and just plug in their laptops...

    tsg

    • 1

  5. With certain switches you can restrict exactly what ip addresses are allowed on each port. For example, on a Cisco you could do:

    ip access-list standard fa001
permit 192.0.2.1
int Fa0/1
ip access-list fa001 in

    What this means is that the only ip address allowed to be on the device on Fa0/1 is 192.0.2.1. If the user tries adding other ip address, they'll get no where.

    Of course this will only work where each host has a static ip. It might work as well with DHCP!

    This is on Cisco, but I'm sure other switches have similar features.

    • 1

  6. You have some DHCP server running on your network that gave it this address. Could be a DHCP router/ switch (probably) or just some box with dhcpd running on it. Which makes it kind of a network-server. It is very normal that you get conflicts and other problems when you use both techniques on 1 network.

    • 0