karldenton Posted March 2, 2009 Posted March 2, 2009 OK. Some bright student has found out the IP address of our proxy server (internal). We're not happy with them using the internet on weekends and evenings via their laptops. I can secure the Wifi points so they can't connect via them. Is there a way to block them having access when plugged in? Can find out the MAC address if need be. Many thanks. PS - Not using ISA
rad Posted March 2, 2009 Posted March 2, 2009 The MAC address would be the only way to definatly block them and lock the Wireless. Only way they can get on again is by using another laptop.
FN-GM Posted March 2, 2009 Posted March 2, 2009 Im lost here, why does it matter if they have your proxy server IP? Surely a WIFI key would sure the problem of them getting an internet connection.
karldenton Posted March 2, 2009 Author Posted March 2, 2009 Yeah but some decide to plug in too with patch cable !! Looking for a FREE way if possible to block both
karldenton Posted March 2, 2009 Author Posted March 2, 2009 Yes its a boarding school and no we're not using ISA. We're using Avantis ContentCache
srochford Posted March 2, 2009 Posted March 2, 2009 The MAC address would be the only way to definitely block them and lock the Wireless. Only way they can get on again is by using another laptop. Or they could just sniff the traffic using wireshark, find a MAC address which does work and set their MAC address to match. Quite a few network card drivers allow you to specify the MAC address you want to use (eg my laptop has a Broadcom and there's a simple option in Windows to just enter an address) A few things I can think of; 802.1x authentication on your switches could block access (it might take time to set up but if you already have a Radius server it's probably not too hard). If you can specify times on the proxy server when certain users are allowed then that might be an easy way (ISA does this which doesn't help; pretty sure you can do it with Squid)
FN-GM Posted March 2, 2009 Posted March 2, 2009 What content filter do you have? You could find the mac of the laptop and give it a dummy address in DHCP.
karldenton Posted March 2, 2009 Author Posted March 2, 2009 Another thread on here says that you can block the MAC address in dhcp so PC Doesn't pick up an IP? Content Filter provided by ISP and a bit via the ContentCache.
Michael Posted March 2, 2009 Posted March 2, 2009 It's difficult as there's no 'real' way to stop this. DHCP was designed to seek and allocate an IP to any device it finds. In saying that, you could schedule DHCP server to stop and then restart an hour before you get into work @echo off net stop "DHCP Server" Exit @echo off net start "DHCP Server" Exit This wouldn't stop them entering a static IP however. You could also put a Power Timer on all switches so they power off, apart from your core switch with your servers and admin workstations. This would definitely sort them out
FN-GM Posted March 2, 2009 Posted March 2, 2009 Even better setup something on your proxy to power it down and up again. A script to disable the NIC and start it again. If you had ISA you could configure it so only machines in AD and use the internet.
Fraser-09 Posted March 2, 2009 Posted March 2, 2009 What about blocking your proxy server internet access in your firewall outside school hours. This would block everyone's internet so it's prob not the solution your after!
tom_newton Posted March 2, 2009 Posted March 2, 2009 1. Get a proxy/filter which has AD authentication 2. Set a rule banning 'net access for students and the terminally unauthenticated after 10pm or what have you 3. job done
GrumbleDook Posted March 2, 2009 Posted March 2, 2009 If you want to be horrible then you could have DHCP running but all clients are assigned a reserved IP based on MAC address, the remainder of the scope passes it to a different gateway ... one that goes nowhere. They get an address and gateway but it buggers them up for a bit ... just a bit of an inconvenience but every bit that is another layer of annoyance is fun. As mentioned previously, AD assigned authentication internally would work on a filter (AD authentication of client on teh domain as well as the user)
SYNACK Posted March 2, 2009 Posted March 2, 2009 I would look at implementing a solution to stop them getting onto the internal network at all, or restricting them to certain areas of it. You could setup the free PacketFence (PacketFence: Home) software to isolate unwanted hosts or use the included NAP (network access protection) in Windows 2008 Server if you have it, this would get past the simple MAC address check as it looks at the system itself and checks criteria (pretty sure domain membership can be one of these) ITidiots Episode 68: Windows 2008 Network Access Protection :: Tech Videos, Screencasts, Webinars, Techtalks, Tutorials I do agree with the others though in that a proxy that supports AD integration would be the quickest and easiest solution.
Arcath Posted March 2, 2009 Posted March 2, 2009 If you want to be horrible then you could have DHCP running but all clients are assigned a reserved IP based on MAC address, the remainder of the scope passes it to a different gateway ... one that goes nowhere. They get an address and gateway but it buggers them up for a bit ... just a bit of an inconvenience but every bit that is another layer of annoyance is fun. that wouldnt stop them setting a static IP. suppose you could create a "whitelist" of mac addresses in your switches but that would make installing any new equipment annoying, but would mean that at a hardware level thier laptops wouldnt be able to use the network
ssiruuk2 Posted March 2, 2009 Posted March 2, 2009 If your switches support it then turn on port security to help prevent them plugging in with a cable- mine is set for one mac address per port so if a student pulls the patch lead and plugs in an unauthorised device it shuts the port down. Of course that won't stop them where you have outlets where you need lots of different machines to have access (like laptops) at the front of a classroom etc
teddybear Posted March 2, 2009 Posted March 2, 2009 If your switches support it then turn on port security to help prevent them plugging in with a cable- mine is set for one mac address per port so if a student pulls the patch lead and plugs in an unauthorised device it shuts the port down. Of course that won't stop them where you have outlets where you need lots of different machines to have access (like laptops) at the front of a classroom etc supposing a non authorised laptop or device is used, does this not create a whole load of work for you, or can you enable the port again remotely?
Vegas Posted March 2, 2009 Posted March 2, 2009 Do anyone besides the kids use your router at weekends? If not just unplug it!
karldenton Posted March 2, 2009 Author Posted March 2, 2009 Thanks for the replies guys. I was hoping that some tweek to the system would do it - Damn !! Tom Newton - we are trialing your school guardian at the moment !! Unfortuntely powering off is not an option as staff use it on a weekend too
karldenton Posted March 3, 2009 Author Posted March 3, 2009 DHCP Block on Mac address might be the option, just tried on my iphone and does the job so trying with a cable now. Given the false router address.
tom_newton Posted March 3, 2009 Posted March 3, 2009 karl - duh - I should have remembered, I spoke to you before I went on my holidays. Brain is still in Nairobi, clearly
Michael Posted March 3, 2009 Posted March 3, 2009 DHCP Block on Mac address might be the option, just tried on my iphone and does the job so trying with a cable now. Given the false router address. You can still allocate a static IP address however. Thinking about it more, the solution to this problem isn't really DHCP; it's definitely the proxy side of things. They're connecting through the proxy to surf the internet. That's the students whole purpose, so re-configuring permissions or time restrictions on the proxy would be the answer.
karldenton Posted March 3, 2009 Author Posted March 3, 2009 You can still allocate a static IP address however. Thinking about it more, the solution to this problem isn't really DHCP; it's definitely the proxy side of things. They're connecting through the proxy to surf the internet. That's the students whole purpose, so re-configuring permissions or time restrictions on the proxy would be the answer. Your right but the proxy we have at present doesn't allow that, plus its weekends, so the staff are using the internet too. Not sure the kids would be bright enough to assign static IP !! (Or i hope not)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now