hello all
i love mikrotik 2 much but when i face this problem i hate them 2 much , this big company can’t solve rogue DHCP servers problem
i fallow this steps to block the rogue DHCP .. i dont know if this steps can protect my server and my clients !!
/ip firewall filter add chain=forward action=drop protocol=udp src-address=!192.168.10.1 src-port=67 dst-port=68
can i protect my server via switch with firewall ( if yes recommend some switch please )
Absolutely. I’ve never used it but the CRS line seems to support it at least kind of with protocol level isolation. https://wiki.mikrotik.com/wiki/Manual:CRS_examples#Protocol_Level_Isolation
Alternatively, Cisco’s product have a feature called DHCP Snooping on their switches which would prevent what you are talking about. It is typically paired with dynamic ARP inspection and IP Source Guard to aid in preventing MITM attacks from ARP spoofing. The nice thing about Cisco is they have features in place to protect DHCPv6 and neighbor discovery. This can be critical if your hosts have IPv6 enabled even if you don’t have IPv6 upstream in your network.
Quick question,
How many devices do you have on the network?
44 device
are u mean manged switch or unmanged can u recommend some model name please i want to solve this big issue it’s destroy my business and im losing my clients !!
I totally understand the protections afforded by technology that can prevent this from ever happening. With that few of devices have you tried a policy approach with enforcement? I’m not sure what type of environment you have but if it is a business it seems like it’d be easier to take care of the bad employees first. As an ISP you could refuse to service someone who tries to do this with malicious intent.
The Cisco gear has had DCHP Snooping for a long time. Their current 48 port edge switch models are the 2960-L, 3650 and 3850s. The DHCP snooping features are available in all of them at all license levels. The 2960-L is likely to the be the most cost effective option. You also can go the eBay route. Don’t quote me but I believe IPv4 DHCP snooping has been available as far back as the 3550 models. You can pick up a 2960 variant that would do it for less than 100USD. Yes they would be managed switches.
^^ Datasheet for the 2960Ls
thanx u very much dear for ur quick replay …
it’s just a small business there is no employee just me im providing an area with wireless i used mikrotik router for hotspot , anyway i’ll check those items on ebay and i’ll post back
have a nice day …
Something like this would do the trick on a budget.
it;s 2 much ports man i dont need this much i need one with 8 or 16 port !!
can i run this series of switches unmanaged ?? and does this protection techniques work if i convert it unmanaged ?
Ah thought you had 44 devices at 1 per port. No biggy ya Cisco has stuff from 8, 16, 24 and 48. I would take a managed switch any day. How else would you configure it? Most of the newer stuff have dedicated management ports that would be protected from your normal network. That said the cost per port doesn’t scale especially if you go with the used market. The most common used hardware will be the 24 or 48 port models.
i found this one it’s used and it’s support 10/100/1000
Cisco Catalyst 2960G WS-C2960G-24TC-L 24-Port Managed Gigabit Ethernet Switch
http://www.ebay.com/itm/232316924948
does it support dhcp snooping protection and can solve my problem !!
cost is 100USD
yes it does.
but you could also buy a new Mikrotik CRS router for roughly the same amount.
But Cisco is a better switch evethough it is used.
Or If you have Mikrotik on the edge ports (where APs are connected) you could use this thread and it could help you solve your problems:
http://forum.mikrotik.com/t/crs-dhcp-snooping-port-level-isolation-not-working-solved/92522/1
Yup it will evilcode1. I’d suggest you try and secure the one I linked earlier.
The 3560G is capable of a large amount of additional features in case you decide you want to do more down the road all while offering more ports for growth.
Here is a video by a popular trainer where he configures DHCP snooping.
https://www.youtube.com/watch?v=xxC4HXFPF4I
Like Anthony says you’ll need this command for either a Cisco or MikroTik DHCP Server:
no ip dhcp snooping information option