Does static mapping work in kea DHCP?
-
@wgstarks said in Does static mapping work in kea DHCP?:
set a static address on each machine
Noop.
No need to touch any of your networked devices.
That is : every device that add to your network : take a picture of the sticker that mentions the MAC.
Then go to pfSense and make this list longer :
I just added the MAC of a new device, was using KEA (I made the switch this morning), and the device got the IPv4 I specified - outside the DHCPv4 pool.
So, again : leave all device on 'DHCP' - no need to set a network, DNS, gateway etc on every device.
For the IPv6 lovers :
I tend to say : note also the DUID ..... but I've never saw a sticker mentioning that one
So : DHCP logs came to the recsue : connect the device, and have it atributed an IPv6 out of the IPv6 pool, from the DHCPv6 server.
Copy paste the DUID under the DHCPv6 lan server settings.
The same procedure as what has been done with the MAC under IPv4.
And done : have your device reconnect (rip ouit the cable a moment) your device now reconnect, using the (GUA) IPv6 you wanted it to have (don't care about the "fe80::4904:ee61:c85e:3bb4%9(prefered)" as humans shouldn't use that one anyway.About DNS :
When you add a item under
it will get added to this file /etc/hosts - please don't believe me, check for yourself :
Here is mine :127.0.0.1 localhost localhost.bhf.tld ::1 localhost localhost.bhf.tld 192.168.1.1 pfSense.bhf.tld pfSense 2a01:cb19:9xx:a6dc:92ec:77ff:fe29:392c pfSense.bhf.tld pfSense 192.168.1.2 bureau2.bhf.tld bureau2 192.168.1.3 TL-SG108E.bhf.tld TL-SG108E 192.168.1.4 poweredget310.bhf.tld poweredget310 192.168.1.6 gauche2.bhf.tld gauche2 192.168.1.7 droite.bhf.tld droite 192.168.1.8 dvr.bhf.tld dvr 192.168.1.11 bureau.bhf.tld bureau 192.168.1.16 ricoh.bhf.tld ricoh 192.168.1.17 clim.bhf.tld clim 192.168.1.18 liveradio.bhf.tld liveradio 192.168.1.23 kindle-f2051e0a8.bhf.tld kindle-f2051e0a8 .......When unbound starts, pfSense will create a (var/unbound/)unbound.conf file.
This file contains :... # Static host entries include: /var/unbound/host_entries.conf ....The unbound pfSense startup code will create this file (/var/unbound/host_entries.conf) from the /etc/hosts file.
Please, have a look at your /var/unbound/host_entries.conf
So, yes, local "DHCP Static Mappings" entries will make local host names known.
Proof of concept - dvr is a host name of one of my devices on my LAN :
C:\Users\Gertjan>ping dvr Envoi dâune requĂȘte 'ping' sur dvr.bhf.tld [2a01:cb19:9xx:a6dc::7f] avec 32 octets de donnĂ©es : RĂ©ponse de 2a01:cb19:9xx:a6dc::7f : temps=1 ms RĂ©ponse de 2a01:cb19:9xx:a6dc::7f : temps=1 ms RĂ©ponse de 2a01:cb19:9xx:a6dc::7f : temps=2 ms .... -
@wgstarks I've been finding that IP static mappings don't work properly either, if a dynamic address has already been assigned.
I had this issue with several IoT devices where I'd connect them to the network and then grab the MAC from they leases to add to a static entry, but after restarting they'd continue on with the same IP.
I thought this was an issue with the new firmware on those devices, but just today I had similar issues with a pi.When connecting via wifi, I can even release the IP on the pi but the leases continue to show the IP as active (which means I cannot release) and a new request gets offered the same IP, with KEA ignoring the static mapping. Only way to get the static to work is to wait for the dynamic address to expire.
-
@phormix said in Does static mapping work in kea DHCP?:
Only way to get the static to work is to wait for the dynamic address to expire.
Thatâs what Iâve been doing too.
-
@wgstarks I just switched back to ISC. Of course now that means the warnings about it being deprecated are front-and-center but KEA just feels like it's still beta quality
-
@phormix said in Does static mapping work in kea DHCP?:
KEA just feels like it's still beta quality
I mean, it literally is? "feature preview"
https://docs.netgate.com/pfsense/en/latest/releases/2-7-1.html#kea-dhcp-server-feature-preview-now-available -
@phormix said in Does static mapping work in kea DHCP?:
the warnings about it being deprecated
Well turn if off if you want... Its right there where you switch..
I mean, it literally is? "feature preview"
Exactly and a "preview" is not even alpha level normally.. A preview is like a taste of what is to come, but the artist really hasn't even started the painting yet... It's like the first rough sketch..
Think of it like this.. Kea currently is left
if your a windows users, think of it as the "canary" channel would be my take if you run the preview builds.
edit: here was my test of kea;
Well it hands out an IP, that's cool
Wow they need to spend some time on the logging - its horrible! ;)
Back to ISC.. -
@johnpoz you can, but here's the thing:
Redhat6 is deprecated. Windows XP is deprecated. SSLv3 is deprecated.
What do all of these things have in common? Well you shouldn't be using them, there's a newer solution that provides essentially the same function, and you really shouldn't be using the old one.
If ISC DHCP is deprecated, but KEA doesn't fill that gap. Per the ISC's posting, it's essentially "hey, this does all we need it to do and we don't want to introduce instability with significant feature changes, if you want those use KEA, but we will keep an eye for significant flaws in the old code and still potentially fix those"
I'd say messages stating ISC DHCP is deprecated may be dropped are not a great look, at least until KEA is more stable and robust. A better message would be that ISC DHCP no longer offers new features, and users are encouraged to try KEA (with some notes that bugs are still being printed out). Pushing people towards an unstable or feature -poor product with alarmist messaging is never a good idea.
So yeah, back to ISC it is for now
-
Not going to disagree that that wording could of been better..
Been a lot of threads where users fail to even read the release notes, and just click to switch because of the warning..
Like this one - nobody that read the release notes about all the stuff missing would think hey lets switch to kea now, unless they were running the most basic of setups with - hey hand out some IPs..
But on the other hand, most all the threads here are because someone fail to read the documentation in the first place ;)
-
@phormix
First off I agree the wording could have been way different. It came up here within days I think, and the answer was, essentially, âthe note is correct, it will be removed, it doesnât say anyone needs to use Kea.â Itâs led to unnecessary alarm, and confusion/frustration.Redhat6 is deprecated. Windows XP is deprecated. SSLv3 is deprecated.
Iâm going to nitpick a bit but I see it a lot. Those arenât deprecated those are discontinued and unsupported. I think the word has shifted in meaning over the years in common speech from âwill be removedâ to âpast EOLâ to âhas been removed,â and they are using the former, original meaning. I tried to look it up to be specific and the definition seems to vary quite a bit around/between those.
If it was replaced they would replace it.
-
@SteveITS exactly.. Deprecated does not mean - hey stop using this, it no longer works, or there is a serious exploit ;)
-
Does anyone know if KEA DHCP integration to DNS Resolver will be fixed in 24.03 ? I would really want to migrate off of ISC.
As stated above, deprecated does not mean it is not available and is still stable. But deprecated software is a highly visible target for bad actors to start to find new vulnerabilities. Then heavily exploit it as deprecated means no more patching. There used to be a time that depricated meant no more licensing and minimal maintenance, it worked, you just left it alone. Not anymore, every security camp either ring fences software off the patch cycle or pushes to remove it all from the network.
-
@gauthig said in Does static mapping work in kea DHCP?:
highly visible target for bad actors to start to find new vulnerabilities.
Not going to disagree with you - but in what scenario would you dhcp server be exposed to "bad actors" in the first place?
Are there any known exploits that are of concern, ISC stated that if something does come up - its quite possible they would patch, etc. Its just really they are no longer going to be developing this product.. So its prob time to move on..
isc dhcp is a very stable and mature product..
-
@gauthig said in Does static mapping work in kea DHCP?:
Does anyone know if KEA DHCP integration to DNS Resolver will be fixed in 24.03 ? I would really want to migrate off of ISC.
Yes, of course.
We're all in the "Here is 23.09.1 (or 2.7.2), and we proudly present KEA" phase.
A minimum GUI parameter set is present, and as much as possible pfSense users out there can test drive KEA now.
If there are none or very view issues with the bare bone functionality : handing out IPv4 and IPv6 leases, then Netgate can continue with adding more 'KEA' options.All they need to do, is picking the right choices from here (
) and implementing them into the GUI.And adding/resolving the long overdue "Register DHCP leases / host names into the local DNS" issue.
-
Definitely
Apart from the DNS resolution issue, everything else been running just fine with KEA. -
@maverickws said in Does static mapping work in kea DHCP?:
everything else been running just fine with KEA.
Yeah it hands out IPs ;) And to be honest, I bet you there are lots and lots of users that have moved over and not noticed anything different.. Their devices get Ips, they renew the lease, etc..
There are many scenarios where it would work just fine I am sure.. Which is why they prob released it "early" if you will.. And put up the notice, hey move over to kea, isc is going away. Because most likely for your typical user - won't even notice it switched over..
To be honest, other than I am not a fan of the current logging, this could use some polish for sure - I could prob switch over to it.. Not much work to just setup host overrides for your devices vs using dhcp reservation registration..
I do hand out some options - but could live without those most likely.
But what you almost exclusively see on forums about product X, is something not working.. You don't see floods of hey works great!!
So yeah, whenever anything changes in product be it good/bad or just "change" you get more posts - quite often from people that just didn't read the docs on what is new or what changed or what is being removed, etc..
I wouldn't expect a flood of posts, hey I moved over to kea - it works just like isc did - why the mention of "preview" ;)
Maybe I missed some posts, but most of the ones I have seen = didn't read the blog post, nor the release notes or just didn't catch or understand what "preview" means ;) Or took hey isc is going away at some future time to mean they "had" to move now or all hell would break loose and the sky would fall ;) And they wouldn't never get a chance to move later and their whole network would come crashing down..
Others just didn't like the warning ;) and didn't notice they could turn it off.. And only way to make the warning go away was switch..
-
@johnpoz well I am definitely missing the name resolution part, I have approximately 1 hundred devices including the smart home stuff, I really don't feel like having to register as host overrides is something that doesn't make any sense to me.
Not only here in my homelab but for example professionally we do have pfSense as well, after creating a fixed lease for a machine being provisioned we do rely heavily on the firewalls name resolving capacity, and wouldn't be feasible to have to register hosts manually for DNS.But anyway as you very well stressed this is a preview, I got KEA running at home, when these issues are overcome we will also adopt on the other instances.
-
It worked fine for me for several months since I donât use name resolution typically. Were I did run into problems was when I replaced an existing device and changed the MAC address used to reserve that IP. KEA wouldnât handout the proper IP until the old reservations had expired for both devices. This made it complicated to access webuiâs to do configurations of devices. Rebooting the Netgate appliance would correct this and maybe there are other workarounds as well but I never really saw any benefit to me running KEA so decided to wait until itâs a little more mature. This really just applies to my use case though. Iâm sure many people donât even use MAC reservations.
-
@wgstarks said in Does static mapping work in kea DHCP?:
Iâm sure many people donât even use MAC reservations.
That might be a good poll.. The only things that don't have reservations on my network - are guest devices, like friends phone on my guest wifi. And devices when I first bring them online.. As soon as its ready to actually join the network full time, it gets a reservation and IP set, etc..
Just powered up my new nvr with cameras for outside.. To just make sure it worked and cameras worked, etc. I just plugged it into port on switch in the av cab.. It came up on my roku vlan.. Made sure it all worked - then setup a reservation for it on my new cam vlan.. Changed the config on the port on that switch, and rebooted it. Now its up on correct vlan, with IP I assigned it, etc..
I would bet many users of pfsense, use at least some reservations.. Can we create "polls" here on the forum, I don't think have ever seen one.. I would be curious to see.. Might throw up something in general off topic section.. even have to just count posts..
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.03 | Lab VMs 2.7.2, 24.03 -
@johnpoz said in Does static mapping work in kea DHCP?:
Can we create "polls" here on the forum
You should probably talk to a Global Moderator about that. ;)
-
@SteveITS ahahahah - oh that is funny ;) hahaha
Here we go, https://forum.netgate.com/topic/186312/do-you-use-dhcp-reservations
Mod is different than Admin btw.. I can delete posts, that sort of thing.. But any sort of backend anything to do with the forums would have to be an Admin... You had me rolling on that comment.. Still giggling.. Good one!
