2

In my LAN I am using a PFSense server with one DHCP server on it.

I need to block a second DHCP server showing up in my LAN. I think I can use the PfSense firewall to refuse the other DHCP server IP address.

What should I do?

2

Unfortunately, you cannot block out a 2nd DHCP in the same LAN (certainly not at firewall level, and mitigating it with high-end enterprise switching equipment is not a simple topic); an IP request is a broacast service, that usually operates at LAN level, and as such there are no routing services to block services at firewall level.

e.g. firewalls do not block conversations between the machines that belong to the same netblock/LAN, however they do control/services doing routing by it to talk with other networks.

The DHCP protocol defines that wichever answer arrives first to a station asking for an IP, it will be the accepted answer. So depending on who wins, workstations will randomly get an IP address from the official or the rogue IP address.

What can be done is mitigation, i.e. finding the MAC of the ofending equipment and searching for it in your switches or blocking that MAC in your switches/wireless AP.

To find it out, either you have two possibly ways:

You go to an affected machine, and try to find out the IP address of the DHCP server that served that request. Or for that matter, release the IP address, and ask for it several times.

Once you have an answer for the foreign router, get that IP address (for instance, with ipconfig /all in a Windows client), than to get that MAC address, then supposing the IP address of the rogue DHCP is 1.1.3.200:

$ping -c1 1.1.3.200 
PING 1.1.3.200 (1.1.3.200) 56(84) bytes of data.
64 bytes from 1.1.3.200: icmp_seq=1 ttl=255 time=0.273 ms

--- 1.1.3.200 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.273/0.273/0.273/0.000 ms
$arp -a 1.1.3.200
xxxx.local (1.1.3.200) at 00:0b:fc:07:04:01 [ether] on eth0

Or my preferred way, in a Linux box, you use tcpdump to listen for a couple of DHCP requests (the box has an horizontal slider to see all the text)

sudo tcpdump -n -c 10 -e port 68
09:23:57.298176 00:21:97:c6:76:fc > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.2.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:21:97:c6:76:fc, length 300
09:23:59.034798 00:19:21:3c:2c:22 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.116.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:19:21:3c:2c:22, length 300
09:24:00.191144 64:00:6a:09:58:16 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.142.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 64:00:6a:09:58:16, length 300
09:24:07.325291 6c:62:6d:d0:20:f4 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.2.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 6c:62:6d:d0:20:f4, length 300
09:24:31.500826 00:23:24:06:e8:0b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 363: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:23:24:06:e8:0b, length 321
09:24:31.502554 00:0b:fc:07:04:00 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.254.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
09:24:31.502812 00:0b:fc:07:04:01 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.200.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
09:24:32.098505 00:0f:fe:fd:6c:27 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.10.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:0f:fe:fd:6c:27, length 300
09:24:49.340908 64:00:6a:09:05:6d > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.174.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 64:00:6a:09:05:6d, length 300
09:24:53.444891 ac:16:2d:08:44:1b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 1.1.3.170.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ac:16:2d:08:44:1b, length 300

Whatch out for the lines that say DHCP Reply:
in this example, the DHCP server is 1.1.3.254 and has the MAC 00:0b:fc:07:04:00; the 2nd one has the IP address 1.1.3.200 and has the MAC address 00:0b:fc:07:04:01 (6th and 7th lines from the output).

  • i see so now i try to test it .how Thinking is not the same as reality. – zore lu Apr 22 '17 at 9:27
  • @zorelu tried to explain it better; made new edits. I am having trouble understanding your comments. – Rui F Ribeiro Apr 22 '17 at 9:34
2

I have used DHCP starvation (targeted specifically at the rogue DHCP server) for longer periods of time. Try dhcdrop or dhcpstarv, or a scapy script. I eventually went with the latter because it was more flexible. In both scapy and dhcpstarv it is possible to target the offending DHCP server without interrupting a legitimate service.

Some routers and switches can drop links to hosts which offend against a set of rules. See this Cisco support thread for example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.