[ILUG] Managing web access while using DHCP

[Kenn Humborg]

> Hi All,
> I'm involved in migrating a network from static IP addresses to
> dynamic.  I
> have the DHCP server up and running fine.  My question is this:  at the
> moment we allow access to the internet on an IP by IP basis.  We
> simple put
> the users static IP address into the firewall and allow it through.  Now
> that we are starting to use dynamic addresses, this situation can not
> continue.  Otherwise, every time a users reboots and happens to get a
> different address they loose their net access until I allow it
> through.  We
> do not want to give the whole range access.  Anyway, I've no doubt that
> there is a simple solution.  I believe it may have something to do with
> using a proxy server, which at the moment we do not have.  If it does, it
> there a good simple Linux one available.  I do not want to give users
> unlimited leases on addresses either as this defeats the purpose of having
> DHCP.

Don't give unlimited leases.  Give fixed addresses instead.  For example:

        host apollo {
                hardware ethernet 00:a0:24:2e:7f:48;
                fixed-address apollo;
        }
in /etc/dhcpd.conf will ensure that this machine always gets
the same address (dhcpd will do a DNS lookup to get the
actual IP address for apollo.bluetree.ie).

So you tie IP addresses to ethernet addresses.  Then you can
effectively control firewall access by machine again.  You could
define one range of addresses for 'good guys' and tie them to
machines as above, and leave another range that is dynamically
assigned at 'random' for the 'bad guys', so you don't need to have
a host entry for every single machine - only the 'good guys'.

> ______________________________________________________________________
> Important Email Information
>
> The information in this email is confidential and may be legally
> privileged.
[...snip...]

Yadda, yadda, shite...  _Is_ confidential?  What a load of crap.

Later,
Kenn