Most computer users never touch their network configuration. The router hands out an address, the computer accepts it, and everything works, until it does not. When things break, or when security becomes a concern, the tools most people fear are actually the most reliable: the Windows Command Prompt and its network commands.
IP configuration is a security issue as much as a convenience issue. A weakly configured address can expose a device to spoofing, interception and unauthorized access. A static address, a hardened DNS setup and a properly configured firewall are basic defenses that most users ignore until after an incident. This guide walks through the fundamentals of IP security and the exact Command Prompt commands to configure your network safely.
Why IP configuration is a security issue
The cybersecurity landscape is full of sophisticated attacks, but many of them succeed because of basic misconfigurations. Attackers target the network layer precisely because it is the layer most users never inspect. They do not need to defeat your antivirus if they can redirect your traffic, impersonate your device or join your network unnoticed.
The practical risk profile for an average user includes: devices that reveal themselves on the network, DNS settings that silently route traffic through a hostile server, and firewall rules that allow more than they should. All of these are configuration problems, and all of them are fixable from the command line without third-party software.
The motivation for learning the commands is simple: configuration is security. Knowing what your machine is actually doing on the network, rather than assuming the defaults are safe, is a meaningful step up in your security posture.
Understanding the anatomy of an IP address
An IP address is the identity of a device on a network. In IPv4, it is four numbers separated by dots, such as 192.168.1.10, and it is divided into two parts: the network portion and the host portion. The subnet mask, written as 255.255.255.0 or as /24, defines where the boundary lies.
This structure matters for configuration because choosing the wrong address or mask can isolate a device from the network, or worse, place it in a network segment with the wrong security properties. When you set a static address, you are taking responsibility for choosing values that the network actually uses: a valid address in the subnet, the correct mask, the gateway and the DNS servers.
The transition to IPv6 is ongoing, and IPv6 addresses are longer and hexadecimal, but the concepts are the same: an address identifies the interface, a prefix defines the network, and configuration must match the infrastructure. For most home and small-business users, IPv4 configuration skills transfer directly, and the commands shown here work for both protocol versions on Windows.
Threats linked to weak IP configuration
Several common attacks depend directly on weak IP configuration:
- IP spoofing: an attacker forges the source address of packets to impersonate a trusted device. Poorly segmented networks and weak filtering make this easier.
- DNS hijacking: if the DNS servers on your machine point to an attacker-controlled server, your traffic can be redirected to fake sites that look legitimate.
- Rogue DHCP servers: an unauthorized server on the network can hand out malicious configuration, including a hostile gateway, causing your traffic to pass through an attacker.
- ARP spoofing and man-in-the-middle: on local networks, an attacker can impersonate the gateway so that traffic flows through their machine, allowing interception and modification.
- Unauthorized access through open services: a device with a misconfigured firewall exposes services to the network that should only be reachable locally.
The defense is layered: verify your configuration, set addresses deliberately instead of accepting anything, pin DNS to known servers, and restrict the firewall to only what is necessary.
Preparing a safe working environment
The first step in any IP configuration task is to run the Command Prompt with administrator rights. Many network commands require elevation, and running them without it produces confusing errors or no effect at all.
To open an elevated prompt: press the Start button, type "cmd", right-click "Command Prompt" and choose "Run as administrator". Confirm the UAC prompt. From here, you have the rights to view and change network configuration.
Before changing anything, capture the current state:
- ipconfig /all shows the full configuration of every interface: current IP, subnet mask, gateway, DNS servers and physical (MAC) addresses.
- ipconfig /release and ipconfig /renew release and renew the DHCP lease, useful when troubleshooting a stale address.
- ping 8.8.8.8 tests basic connectivity, and ping example.com tests DNS resolution. If the first works but the second fails, the problem is DNS, not the connection.
Write down the current working values before you change them. A static configuration is only as good as the values you enter, and the safest source for those values is the current DHCP-issued configuration.
It is also worth checking the physical layer before assuming a configuration problem. A loose cable, a failing Wi-Fi adapter or a switch port in the wrong VLAN can produce symptoms identical to a bad IP address. Run the basic checks, ipconfig, ping, and look at the link speed reported for the interface, before you start changing settings. Configuring a perfect address on a broken link only adds confusion.
Setting a static IP with netsh
The netsh command is the core tool for network configuration from the command line. To assign a static IP address to an interface, you need the interface name first:
netsh interface ipv4 show config
The output lists interfaces by name, such as "Ethernet" or "Wi-Fi". Once you know the name, assign the address, mask and gateway:
netsh interface ipv4 set address name="Ethernet" static 192.168.1.50 255.255.255.0 192.168.1.1
This sets the IP address to 192.168.1.50, the mask to 255.255.255.0 and the gateway to 192.168.1.1. Use the values that match your own network; copying examples blindly is a common source of broken connections.
Verify the change with ipconfig. If you lose connectivity, either you entered values outside the valid range for the network or the gateway is wrong. The rollback is immediate: either correct the values or switch back to DHCP with netsh interface ipv4 set address name="Ethernet" dhcp.
A static address is the right choice for devices that must always be reachable at the same address, such as printers, servers and network storage. For ordinary workstations, DHCP with a reservation on the router is usually a safer option, because it gives you the same stability without manual configuration on every machine.
Hardening DNS through the command line
DNS is the phone book of the internet, and it is a favorite target of attackers. If your machine asks the wrong DNS server, it will receive the wrong answers. Hardening DNS means pointing your system at servers you trust and verifying the configuration.
Set the primary and secondary DNS servers for an interface:
netsh interface ipv4 set dnsservers name="Ethernet" static 1.1.1.1
netsh interface ipv4 add dnsservers name="Ethernet" 8.8.8.8 index=2
The first command sets the primary server; the second adds a secondary. Public DNS services such as 1.1.1.1 and 8.8.8.8 are widely used, but the best choice depends on your threat model and jurisdiction. Some users prefer their ISP's servers for speed or a specific provider for privacy features like encrypted DNS.
To return to automatic DNS from DHCP:
netsh interface ipv4 set dnsservers name="Ethernet" dhcp
After any change, verify resolution with nslookup example.com and check that the answer comes from the expected server. DNS hardening is cheap, invisible when working, and one of the most effective network defenses available.
Advanced hardening: DHCP, firewall and static routes
Beyond the basics, the command line gives you access to three advanced protections.
DHCP auditing: the ipconfig /all output shows the DHCP server and lease details for your interface. If you see a DHCP server you do not recognize, or a lease that seems wrong, investigate immediately; a rogue DHCP server can quietly redirect your traffic. The command-line defense is to use static configuration for critical devices so they ignore rogue offers.
Firewall rules: the Windows Firewall is configurable with netsh. To view the active profile and rules:
netsh advfirewall show allprofiles
Rules are managed with netsh advfirewall firewall add rule and delete rule. The principle is least privilege: allow only the ports and programs you actually need, on the interfaces you need them, and block everything else. Reviewing the list of enabled rules periodically is a good habit; many machines accumulate rules they no longer need.
Static routes: when a network has multiple subnets or gateways, a static route tells Windows which gateway to use for a specific destination:
route add 10.0.0.0 mask 255.0.0.0 192.168.1.1
The route print command shows the routing table. Static routes are powerful and dangerous in equal measure: a wrong route silently breaks connectivity to a whole subnet, so add them deliberately and document what each one is for.
Keeping data safe during transfers
IP configuration and data security connect at the point of transfer. When you move files between devices, upload to cloud services or connect to remote systems, the safety of the transfer depends on the network path and the protocol, not just the IP settings.
The practical rules:
- Prefer encrypted protocols. HTTPS, SFTP and SSH protect the content of the transfer even if the network path is compromised.
- Verify the destination. A pinned DNS configuration reduces the chance of connecting to an impostor server, but certificate validation is the real check.
- Keep interfaces segmented. Use a guest network for untrusted devices and your main network for sensitive work, so a compromised device does not expose your primary assets.
- Monitor what your machine advertises. Tools like netstat show active connections; a machine with an unexpected connection to an unknown address is worth investigating.
A correctly configured IP stack does not make a network invulnerable, but it removes the easy paths. Attackers look for the weakest configuration first, and a device with verified settings, hardened DNS and a strict firewall is not the weakest link.
FAQ
Do I need administrator rights for all IP commands?
Most configuration commands require elevation. Viewing commands like ipconfig and netstat work without it, but anything that changes settings needs an elevated prompt.
Is a static IP more secure than DHCP?
Not by itself. Static IPs are more predictable and avoid rogue DHCP offers, but security comes from the values you choose and the rest of the configuration. A poorly chosen static IP is no safer than DHCP.
How do I know which DNS servers to use?
Use servers you trust and can verify. Public services like 1.1.1.1 and 8.8.8.8 are popular, but the right choice depends on your network, location and privacy requirements.
What should I do if I lose connectivity after changing settings?
Verify the values with ipconfig, compare them against the network's actual range, and roll back to DHCP if you cannot identify the mistake. Document the original settings before making changes.
Can I undo all the changes I made?
Yes. Each command has a DHCP counterpart: set address dhcp, set dnsservers dhcp, and route delete for static routes. The firewall rules you add can be removed with delete rule.
Is IPv6 configuration handled differently?
The commands are parallel: netsh interface ipv6 set address and the equivalent show commands. Most home networks use IPv6 automatically, and the safest approach is to leave auto-configuration enabled unless you have a specific reason to change it.
How often should I review my network configuration?
A quarterly review is a reasonable habit: check the DNS servers in use, list the firewall rules that are enabled, and verify that static addresses still match the network. Configuration drift is silent, and a review is the only way to catch it.
Final thoughts
The Command Prompt is one of the most underused security tools on Windows. The commands to inspect, configure and harden your network are short, deterministic and free of third-party dependencies. What they require is a habit: check the configuration before you trust it, verify after you change it, and keep the surface small.
Start with ipconfig /all and the elevated prompt. Look at what your machine is actually doing. From there, the path to a hardened configuration is a few commands away.
