K-12 Forums

Talk with other K-12 network administrators in your state.

Or see all states.

Categories

Vanilla 1.1.4 is a product of Lussumo. More Information: Documentation, Community Support.

This discussion has been inactive for longer than 30 days, and is thus closed.
    • CommentAuthorrwandering
    • CommentTimeFeb 23rd 2008
     permalink
    Something I must be missing about dynamic IP support in OpenDNS.

    Don't data and services get co-mingled (or just plain mishandled) when dynamic IPs change (i.e., when OpenDNS receives DNS queries from an IP that it thinks belongs to someone else)?

    For example, if someone else is blocking domains and using an IP address that I am subsequently assigned by my ISP, then don't I get blocked too? At least until the dynamic IP updates occur by either me or the other customer? What about the case when the other customer doesn't do these updates at all . . . maybe doesn't have the technical ability to do it? What about the case for OpenDNS users who don't have accounts at all?

    Am I missing something here? I hope I am.
    • CommentAuthorpencoyd
    • CommentTimeFeb 23rd 2008
     permalink
    Yes, we depend on having the proper public IP, including dynamic IP updates.

    The few times we've had problems, it's easily cleared up by our support team. We're always looking for ways to make dynamic IP support easier for users. DNS-O-Matic is a long-term step in that direction.
    • CommentAuthorrwandering
    • CommentTimeFeb 24th 2008
     permalink
    This seems to me like a deal breaker for dynamic IP use of the entire OpenDNS system. I don't ever want OpenDNS to facilitate others tracking my DNS use (intentionally or not), or to accidentally impose services on me.

    You could mitigate this if you . . .
    a) allowed IP addresses to be declared dynamic (or better, deal with all of them as dynamic unless proven static).
    b) for such addresses, disable all OpenDNS services if the IP hasn't been updated within some short period of time.
    c) quarantine all DNS history for those IPs, releasing it for storage (and display) only if the subsequent IP update matches the previous update (i.e., the same user updated the IP). Otherwise, purge it.

    A major issue here is if user A creates an account with a dynamic IP and never updates it. user B comes a long (no account necessary) and starts using OpenDNS. When they get the first user's IP, the problem happens and, worse, user B never knew this was a possibility.

    Troubling.
    • CommentAuthorpencoyd
    • CommentTimeFeb 24th 2008
     permalink
    @rwandering - look in the Dashboard.

    1. We ask people to declare their addresses as dynamic. https://www.opendns.com/dashboard/settings/
    2. Stats are turned off by default for accounts... you need to turn them on.

    We've got like 4 million people using our service daily, and this crops up rarely.

    Of course, we don't want it to happen at all, so we're continuing to streamline and improve the edge cases. It can happen, but for the reasons cited, it's not a major issue...and we won't let it become one.

    Thanks for paying attention.

    John
    • CommentAuthorrwandering
    • CommentTimeFeb 24th 2008
     permalink
    Yeah, I see that people declare the IP dynamic, but by default your service assumes they are not. I'm surprised that these so-called "edge" cases aren't clearly spelled out.

    The only reason this may not be a major issue is due to penetration . . .

    Thanks for your response -- I'm not convinced.
    • CommentAuthorvogtadi
    • CommentTimeApr 24th 2008
     permalink
    I am not convinced either.

    I had such an "edge case" yesterday, when my ISP assigned my such an allready configured IP address. Although support was finally fast in helping, I was initially hard to figure what was going on.

    Even if such addresses are declared dynamic, they need to be actually updated. So if user A (as in above example) never updates it we are already in trouble.

    I think the CURRENT owner of the IP should have some kind of priority, e.g. updating HIS dynamic IP should automatically "invalidate" such IP Addresses and disable the settings for that user. Only if that user himself updates the dynamic address of his line they should become active again.

    This way "forgotten" settings would clear out automatically, without interaction. Certainly a benefit for the future where the penetration of the service might increase.
    Thankful People: srday, appus, aweaver33
    • CommentAuthoryschandra
    • CommentTimeMay 6th 2008
     permalink
    Just wondering how opendns services behave in following 2 scenarios (dynamic IP)

    1) user A uses opendns servers as well as other services of opendns and he doesn't update or use his netwrok (ex: dsl connection) for some time and then user B from same ISP gets same dynamic IP and happen to use only opendns servers not any other stuff including dns-o-matic.

    Is user B is treated as user A and his filter setting etc. are used for user B?

    2) Only change from 1) is that user B also uses all services and updates his dynamic IP with dns-o-matic

    Now 2 accounts on opendns have same IP, how are the stats and other stuff is treated?

    I could see I have some site accesses from my network at the times I am not around at home and blocked sites which are not supposed to be blocked according to my filter settings.
  1.  permalink
    It would be nice to be able to configure the OpenDNSUpdater to use only specific networks... perhaps using the named networks as defined in Vista.

    BTW, the maximum IP Check interval in the Updater is 120 minutes. I'd guess then that the OpenDNS servers probably clears settings for a dynamic IP after about that.

    I've noticed that my Cox cable modem provides my router with a private (10.x) IP address. This suggests that many users are (or at least could be) sharing the same public IP via NAT. I don't think it's going to be reasonable to presume a 1:1 subscriber:public_IP.
    • CommentAuthorappus
    • CommentTimeJun 7th 2008
     permalink
    well, i got the same issues two times so far ! update.microsoft.com was blocked and i had to get a new public ip by restarting router !

    You mention everywhere "put this ip in your dns settings" . many people wont be bother to update their ip or blacklist some site. So people who are having less knowledge about OpenDNS is suffering !

    You guys are saying millions of people are using this service. the more people use this service, the more problem we face ! Either you give your service only to Static IP's or stop that blacklist service !
    • CommentAuthormamazitta
    • CommentTimeJun 7th 2008
     permalink
    @appus

    Using OpenDNS only, such as you stated "put this ip in your dns settings" does nothing. It just uses OpenDNS for DNS inquiries rather than users ISP's DNS.
    You must create an account in order to take advantage of any blocking activities. If you cannot setup and manager your account properly, shame on you.
    • CommentAuthorrotblitz
    • CommentTimeJun 7th 2008
     permalink
    @appus
    You are right, this is a well known problem, and reported in many threads here in the forum already. I am sure that OpenDNS are already looking for a solution to overcome this. My proposal is the same as several other users have expressed: the current "owner" of a dynamic IP address should be the winner over a lazy user, who did not update his/her IP address.
    • CommentAuthorDon
    • CommentTimeJun 25th 2008
     permalink
    Why can't OpenDNS release an old Dynamic IP once a Dynamic IP user adds a new network? I had 6 IPs configured. I just deleted 5 of them, for someone else to use. It seem like it would be an easy fix. It can be automatically deleted once I add a new one or make me delete it before I can add a new one.
    • CommentAuthorMarc
    • CommentTimeJun 25th 2008
     permalink
    That way any user behind a filtered network (e.g. in schools) could take over the IP and unblock everything.

    I never had problems with the way it currently works. Dynamic IP's are released after some hours.
    • CommentAuthoraweaver33
    • CommentTimeJun 29th 2008 edited
     permalink
    Most large networks that are concerned about users taking over the settings will have a static network address. If static accounts are exempted from an automatic takeover, they're safe.

    Of course this really only works if accounts are assumed to be dynamic unless the user explicitly configures it as static. This is a problem that is only going to get worse until something is done about it.
    • CommentAuthoruzun
    • CommentTimeJun 29th 2008
     permalink
    Hello guys.. I am living in a hostel. My network of admin has blocked port of my game. (Port : 7000) Is there any way escape the blocking or what else?

    I really need it :)
    • CommentAuthoraweaver33
    • CommentTimeJun 29th 2008
     permalink

This discussion has been inactive for longer than 30 days, and is thus closed.