Restrict IPs been added
Restrict the ability to add ip's to the server to only allow ip's that are within network ranges of interfaces that are active on a system.
Ie, at the moment, it is easy to add an ip that you have no interfaces for (outside of your network). Ie google's IP address. Once added none of the customers on the server are able to contact google!
I wouldn't think it would be that difficult. Ie grab the subnet mask of the active interfaces on the system...