Help me with dhcp

[thomasassina]

Now I have pfsense runing on my wired network with about 50 computers connected now. My problem now is anytime someone plugs in the cat5 into their personal computer the dhcp gives them IP. I want it to give IPs to anly workstations not personal computers. How do I do that?

[johnpoz]

Well you could enable "Deny unknown clients"  And create reservations for all your workstations.

From a general security setting any ports not in use should be disabled, if users are plugging into unused ports those ports should be off in the first place.

Now sure what your using for switching, but many managed switches provide for port security.  Look into cisco port security for example.

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/port_sec.html

This can allow you prevent users from unplugging their workstations from the port on the wall and plugging in their devices.  Now if they are smart enough to change the mac your out of luck :)

But this is more security than just not giving them a dhcp address.  You can also enable Static ARP entries in pfsense, now it will only talk to devices it has reservation for, etc.  This prevents users from just putting in a static IP on your network.

You could look into a fullblown NAC or NAP..
http://en.wikipedia.org/wiki/Network_Access_Control

Something like http://www.packetfence.org/ comes to mind.