Using a graphical user interface

1. Open the DHCP snap-in.
2. In the left pane, right-click on DHCP and select Add Server.
3. Type in the name of the DHCP Server you want to target and click OK.
4. Expand the server entry in the left pane.
5. Expand the scope you want to set options for.
6. Click on the Scope Options icon. In the right pane, you will see the list of options currently configured for the scope. This will include any server options that have been configured.
7. To modify an option, double-click it in the right pane. To configure a new scope option, right-click on the Scope Options icon and select Configure Options.
8. Check the box beside the option you want to configure. This will make the Data entry section of the dialog box active.
9. Enter the value(s) for the option and click OK.

Using a command-line interface

The following command configures a scope option:

> netsh dhcp server \\ scope  set optionvalue   

In this example, the “default router” option (code 3) is configured with a value of 192.168.10.1:

> netsh dhcp server \\dhcp01 scope 192.168.10.0 set optionvalue 3 IPADDRESS 192.168.10.1

You can view all of the scope options for a scope with this command:

> netsh dhcp server \\ scope  show optionvalue

Using a graphical user interface

1. Open the DHCP snap-in.
2. In the left pane, right-click on DHCP and select Add Server.
3. Type in the name of the DHCP Server you want to target and click OK.
4. Expand the server entry in the left pane.
5. Click on Server Options, then right-click it and select Configure Options.
6. Check the box beside the option you want to configure.
7. This will make the Data entry section of the dialog box active.
8. Enter the value(s) for the option and click OK.

Using a command-line interface

The following command configures a server option:

> netsh dhcp server \\ set optionvalue   

In the following example, the “domain name” option (code 015) is configured with a value of “rallencorp.com” on the DHCP server named dhcp01:

> netsh dhcp server \\dhcp01 set optionvalue 015 STRING rallencorp.com

You can view all of the server options that have been configured with this command:

> netsh dhcp server \\ show optionvalue

Using a graphical user interface

1. Open the Control Panel.
2. From the Network Connections applet, open the connection you want to configure.
3. Click the Properties button.
4. Select Internet Protocol (TCP/IP).
5. Click the Properties button.
6. Click the Advanced button.
7. Click the Options tab.
8. Select TCP/IP filtering.
9. Click the Properties button.
10. Check the box beside Enable TCP/IP Filtering.
11. Select Permit Only for TCP Ports, UDP Ports, and/or IP Protocols.
12. Click the Add button.
13. Enter the port or protocol number and click OK.
14. Repeat the last couple of steps until you’ve entered all desired ports and protocols.
15. After you are done, close all the dialog screens by clicking either OK or Close.
16. You will be prompted to reboot for the changes to take effect.

Using a command-line interface

The following command enables TCP/IP filtering:

> reg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /vEnableSecurityFilters /t REG_DWORD /d 1

You must reboot for the changes to take effect. To disable filtering, change /d 1 to /d 0.

Next, configure the protocols and ports you want to filter. This must be done on a per-interface basis. To configure this using the registry, you need to know the GUID assigned to the interface you want to modify. This is a sample interface entry:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{07383FC4-FF4D-4E16-9DD6-C27061719D76}

To find out what adapter that corresponds with, you can use this command (on Windows Server 2003):

> wmic nicconfig get caption,settingid

Once you know the GUID of the interface, you can use the reg add command to modify the RawIPAllowedProtocols, TCPAllowedPorts, or UDPAllowedPorts values to filter what you want. Each of those values is of type REG_MULTI_SZ. Here is an example of setting protocols 25 and 80:

reg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{07383FC4-FF4D-4E16-9DD6-C27061719D76} /v RawIPAllowedProtocols /t REG_MULTI_SZ /d 25\080

You can also use the WMIC utility to configure TCP/IP filtering. These two commands show you how:

> wmic /node:"<ServerName>" nicconfig call EnableIPFilterSec(1)> wmic /node:"<ServerName>" nicconfig where ipenabled=True call EnableIPSec

(<TCPPortList>),(<UDPPortList>),(<ProtoList>)

This command allows all TCP and UDP ports, but allows only protocols 80 (http) and 25 (smtp):

> wmic nicconfig where ipenabled=True call EnableIPSec (80,25),(0),(0)

Using VBScript

' This code enables IP Filtering for all adapters and configures' filtering for all IP-enabled adapters.

' ------ SCRIPT CONFIGURATION ------

strComputer = "."

arrTCPPorts = Array ( 0 )       ' Allow all TCP ports

arrUDPPorts = Array ( 0 )       ' Allow all UDP ports

arrProtos   = Array ( 80, 25 )  ' Allow only HTTP and SMTP

' ------ END CONFIGURATION ---------

set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

set objAdapterConfig = objWMI.Get("Win32_NetworkAdapterConfiguration")

intRC = objAdapterConfig.EnableIPFilterSec( True )

if intRC = 0 then

WScript.Echo "IP Filtering for all adapters enabled"

elseif intRC = 1 then

WScript.Echo "IP Filtering enabled for all adapters, " & _

"but you must reboot for the changes to take effect"

else

WScript.Echo "There was an error enabling IP Filtering for all " & _

"adapters: " & intRC

end ifset colNAConfigs = objWMI.ExecQuery( _

"select * " & _

" from Win32_NetworkAdapterConfiguration " & _

" where IPEnabled = True" )

for each objNAConfig in colNAConfigs

intRC = objNAConfig.EnableIPSec( arrTCPPorts, arrUDPPorts, arrProtos )

if intRC = 0 then

WScript.Echo "IP Filtering configured for '" & _

objNAConfig.Description & "'"

elseif intRC = 1 then

WScript.Echo "IP Filtering configured for '" & objNAConfig.Description & _

"', but you must reboot for the changes to take effect"

else

WScript.Echo "There was an error configuring IP Filtering for '" & _

objNAConfig.Description & "': " & intRC

end if

next

Filtering by port or protocol can be useful in certain situations, but be aware of the limitations. A good example of when you might want to configure filtering is for external web servers. If your web server is running on the default HTTP port (80) and it is running no other networked application, then you only need port 80 open. But allowing only port 80 traffic also prevents the server from acting as a member in an Active Directory domain (which requires several ports to be open) and makes remote administration difficult because you can’t connect using the Terminal Services client. Obviously you can add these ports to the list you allow, but remember that if you do port/protocol filtering, you must have the ports/protocols open that are needed to support the machine.

1. From the Control Panel, open the Network Connections applet.
2. Double-click the connection you want to configure.
3. Click the Properties button.
4. Double-click Internet Protocol (TCP/IP).
5. To enable DHCP, select Obtain an IP address automatically. To use a static address, select Use the following IP address. Then configure the IP address, subnet mask, and default gateway.
6. Click OK until all windows are closed.

Using a command-line interface

The following command configures DHCP for a connection:

> netsh int ip set address name="<ConnectionName>" source=dhcp

Here is an example for configuring the connection named “Local Area Connection” to use DHCP:

> netsh int ip set address name="Local Area Connection" source=dhcp

This configures a connection with a static IP and default gateway:

> netsh int ip set address name="<ConnectionName>" source=static <IP> <Mask> <GateWayIP> <Metric>

This example configures a static IP address for “Local Area Connection”:

> netsh int ip set address name="Local Area Connection" source=static 10.3.53.3
255.255.255.0 10.3.53.1 1

Using VBScript

' This code enables DHCP for the specified connection.
' ------ SCRIPT CONFIGURATION ------
strComputer = "."
strConnection = "Local Area Connection"
' ------ END CONFIGURATION ---------
set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
set colNA = objWMI.ExecQuery("select * " & _
                             " from Win32_NetworkAdapter " & _
                             " where NetConnectionID = '" & strConnection & "'" )
for each objNA in colNA
   set colNAConfig = objWMI.ExecQuery _
      ("ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID='" & _
        objNA.DeviceID & "'} " & _
      " WHERE resultClass = win32_NetworkAdapterConfiguration ")
   for each objNAConfig in colNAConfig
      if objNAConfig.DHCPEnabled = True then
         WScript.Echo "DHCP already enabled for " & strConnection
      else
         intRC = objNAConfig.EnableDHCP( )
         if intRC = 0 then
            WScript.Echo "DHCP Enabled for " & strConnection
         elseif intRC = 1 then
            WScript.Echo "You must reboot to start using DHCP for " & _
                         strConnection
         else
            WScript.Echo "There was an error enabling DHCP for " & _
                         strconnection & ": " & intRC
         end if
      end if
   next
next

' This code configures an IP address, subnet mask, and default gateway
' for the specified connection.
' ------ SCRIPT CONFIGURATION ------
strComputer = "."
strConnection = "Local Area Connection"
strIP = Array("1.22.2.2")
strMask = Array("255.255.255.0")
strGatewayIP = Array("1.2.3.3")
' ------ END CONFIGURATION ---------
set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
set colNA = objWMI.ExecQuery("select * " & _
                            " from Win32_NetworkAdapter " & _
                            " where NetConnectionID = '" & strConnection & "'" )
for each objNA in colNA
   set colNAConfig = objWMI.ExecQuery _
      ("ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID='" & _
        objNA.DeviceID & "'} " & _
      " WHERE resultClass = win32_NetworkAdapterConfiguration ")
   for each objNAConfig in colNAConfig
      intRC = objNAConfig.EnableStatic(strIP,strMask)
      intRC2 = objNAConfig.SetGateways(strGatewayIP)
      if intRC = 0 and intRC2 = 0 then
         WScript.Echo "IP address configured for " & strConnection
      elseif intRC = 1 or intRC2 = 1 then
         WScript.Echo "You must reboot for the changes to take effect for " & _
                      strConnection
      else
         WScript.Echo "There was an error configuring IP for " & _
                      strconnection & ": " & intRC & " and " & intRC2
      end if
   next
next

If you use static IP addresses, any time you build a new server, you have to configure an IP address on that server. However, there is no reason why you can’t automate the process using either the netsh command shown in the command-line solution or WMI. You still have to find an available IP address, which may not be easy to automate depending on your environment, but at least you can provision the IP address in an automated fashion.

This leads to a discussion of using DHCP on servers. You’ll find some people dead set against it and others who wouldn’t do it any other way. Since network adapters are by default configured to use DHCP, you can remove the step of configuring network settings, such as IP address, DNS servers, etc., on your servers by using DHCP. After the server completes the build process and reboots, it will automatically request an IP address. But as you probably know, DHCP addresses aren’t set in stone. The next time the server reboots, it might obtain a different address. And since you more than likely want to add an A record (and possibly a PTR record) in DNS for this server, if it got a new address, those records would no longer be valid.

There are two ways to work around this. First, you can configure a reservation on the DHCP server for a specific IP address. You only need to retrieve the MAC address of the server’s network adapter order to configure a reservation (you can get this via the ipconfig /all command). With this configuration, the server will always receive the same IP address even though it is getting it from DHCP. The benefit of this is that you don’t have to manually configure the other settings such as DNS and WINS servers directly on the server. The potential drawback is that if you have to change network adapters for any reason, the reservation would also have to be updated.

The second option is to use dynamic DNS to have the server automatically update DNS based on its current IP address. In fact, you could have the sever itself send the dynamic updates or use DHCP to do that. That way, even if the server gets a new IP address after every reboot, DNS will be updated automatically. The benefit to this is that it is the most automated solution. There is very little configuration you have to do on a per-server basis (and it is therefore attractive for large environments). The downside is that DNS could have outdated information for a period of time until the server dynamically updates its new information.

It’s just as easy in Linux; the only hard part is that every distribution puts the configuration file in a different place. In Red Hat and Fedora, edit /etc/sysconfig/network-scripts/ifcfg-eth0 as follows:

TYPE=EthernetDEVICE=eth0

BOOTPROTO=dhcp

ONBOOT=yes

DHCP_HOSTNAME=stinkpad

On Debian, edit /etc/network/interfaces as follows:

auto loiface lo inet loopback

auto eth0

iface eth0 inet dhcp

You may wish to use a graphical configuration tool. On Red Hat and Fedora, use system-config-network. KDE and Gnome have their own GUI configuration tools (as does practically every Linux distribution), so you won’t be short of choices. Another option is netGo, a system-independent network configuration utility that lets you create profiles for easily connecting to different networks