as we all know when we try to change our ip address to use a static ip address in microsoft windows we go for the network connection properties,we also know that entering a new ip address is under some rules and conditions.
microsoft windows will refuse letting you put in the first octet any number above 223 or letters or even zeros
just to let you all know Mikrotik dhcp server v3.30 is allowing you to send ip address ranges to all users on the Lan breaking all these rules
it means you can set 0.1.2.0/24 as a range or even 255.0.0.0/24 which will stop end users from being able to type these ranges manually.
but under one condition
only microsoft windows xp systems and lower will receive that range and be happy
i tested windows 7 and it refuses to take these ip ranges
another problem i also discovered:
any one hacking into mikrotik systems with mac 00:00:00:00:00:00 can;t be blocked by mac which means happy hacking day.
blocking 00:00:00:00:00:00 mac will block the entire mikrotik server ranges on all users
so at the end i request mikrotik team to take the mac problem more seriously
Probably the reason that Mikrotik Support asked is NOT that they do not know, but that maybe you could share your knowledge on this in a public forum for users?
vetusa2, there are several ways to block traffic by MAC addresses in RouterOS.
In “wireless access-list” section 00:00:00:00:00:00 MAC address value is taken as “any MAC address” and not any single numerical value. You need to use IP firewall or bridge firewall filters to block such MAC address. It is best to use security profile features to ensure wireless security: http://wiki.mikrotik.com/wiki/Manual:Interface/Wireless#Security_Profiles
00:00:00:00:00:00 mac address is a security hole in Mikrotik exactly when someone trys to take it either to do an ip scan on the network to get mac addresses of all users or to lunch a dns poisoning attack,you guys should add an option to be able to block any single user from taking that mac address,also like you said security profile is best to use but not the safest since people lately can hack into WEP and WPA using backtrack.
i just wonder what if somone took 00:00:00:00:00:00 mac address then started to attack the entire network!
at the end we all like Mikrotik and his staff that’s why we point out these kind of problems.
what good is 2-3 days, if your dynamic keys are changed every 5 minutes? also your log files will indicate the problem, and that station will be blocked.
what good is you blocking 00:00:00 MAC address? the guy will change it to something else
this is a mikrotik router, it’s not hard to protect it, and it’s not stupid. let’s talk when you actually manage to break it, even if it takes you 2 days.
also, use WPA-EAP to make sure nobody can hack you at all.
on the wireless adaptor only ,MFP is to protect RouterOS to RouterOS from deauth attack but not to protect RouterOS to end users from MAC address cloning issue or deauth attack.
