|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
First off – if you are in the Northern Hemisphere – Happy spring. The tulips are in full bloom at my house. Speaking of houses – and more specifically
[See the full post at: Dynamic or Static? Which do you choose?]
Susan Bradley Patch Lady/Prudent patcher
I use DHCP across the board. But for more important stuff, such as my printer and NAS, I have DHCP reservations added in the router so they’re always assigned the same address.
This is also what I do. I use the DHCP server on the router to reserve some addresses for particular devices involved in providing shared resources. This way the mapping stays “static”.
Also, I think you do not want to just pick a previously assigned IP from the DHCP server’s space of dynamically assignable IP numbers. Often the DHCP server will leave some of the private IP space (192.168.x.y) alone and not assign numbers in that section of the private network space. For example it will leave, 192.168.1.2-40 alone, and start assigning IP numbers “above” 192.168.1.40. In this example, the first dynamic assignment the DHCP server will make will start at 192.168.1.41 . Therefore you’d want to make your static IP assignments within this non-DHCP (2-40) available range to avoid potential future collisions.
There is a bit more to my madness as well. For WiFi and home (not business) devices I use a separate router in a slightly different IP space.
Ontop of that the WiFi router offers a separate vlan with a separate SSID for “guests” that can be isolated from the rest of the home network, and furthermore can optionally be set to not allow any device on that “guest” network the ability to contact/discover any other device on the “guest” network. Beyond the fact that I cannot control what security patches my visitors implement (I have one visitor that thinks they know better than to apply security patches – ever…) I’m also concerned about all the IoT devices hooked up via WiFi. This is because as the saying goes “The S in IoT stands for Security”*. Therefore I generally isolate all these connected devices from each other and the rest of the home network. (It’s a bit less convenient when you first attach a new device to your WiFi, since you often have to turn off this isolating rule on the router, but therein after the device is talking to a cloud account, and your phone app is talking to the same cloud account, and then all is good…. After a few extra incantations and other exclamations )
*Here’s an example of some fine IoT security (NOT) https://www.bleepingcomputer.com/news/security/hackers-can-open-nexx-garage-doors-remotely-and-theres-no-fix/
Basic research is what I am doing when I don't know what I am doing - Werner Von Braun
My modem/router for my Xfinity connection is a Motorola MG7550. I use dynamic addresses, but the MG7550 keeps the same addresses (wired and wireless) through reboot, power failure, etc. My printer has always been 192.168.1.15, for years, even when I changed it from wired to WiFi.
I haven’t had a reason to change to fixed addresses, since I’ve never had any real problem with dynamic addressing.
My practice is to use reserved addresses in my Deco 7200 mesh router for all my wired devices (4 Computers, 1 NAS) and our 2 Printers (wireless). The rest I let the router assign dynamically, but mostly it assigns the same addresses. I also have the router set to give out addresses starting at 100 reserving the lower addresses for Reserved Addresses. And like Susan, have the DHCP set to 1.1.1.1 & 1.0.0.1 respectively.
I use an ASUS router, along with Merlin custom firmware and a sweet add-in called YazDHCP. All of my devices are configured to use DHCP, but the router is configured with DHCP reservations for each device’s MAC address. This way, every device gets the same IP address always, yet I can easily change the address range if I want to (perhaps from the 192.168.x.x range to a 10.x.x.x one). I also assign DNS for all devices from the router. No logging in to lots of different systems if I want or need to make a change.
My old router was running short on NVRAM because of all of the DHCP reservations, but the YazDHCP add-in moved them all to the /jffs partition and now the router is happy and all of my internal links always work. 
Merlin even has an excellent support forum at https://www.snbforums.com/forums/asuswrt-merlin.42/
Everything static. Guests on dhcp. And even guest dhcp are manually turned into reservations in the modem config. I once ran my entire network on ipv6, but that is a hassle to manage manually.
For anyone wanting a background on IP addresses, subnets and static/dynamic assignment of IP addresses, I have a fairly popular writeup here
https://routersecurity.org/ipaddresses.php
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
I use DHCP reservations in my router. DHCP hands out the IP I selected to the MAC address that asks for it for the devices where it matters. The others are assigned from the DHCP pool.
So, I don’t have to configure and maintain static IPs but I still have fixed addresses for servers, scanners and printers!
The best of both worlds!
Martin
I have my Brother printer on a static IP address, it seems faster and more reliable,
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Notifications
