Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Kea DHCP Feature Roadmap

    DHCP and DNS
    13
    30
    4.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Antibiotic @johnpoz
      last edited by

      @johnpoz said in Kea DHCP Feature Roadmap:

      Currently this is no point to switching to be honest

      I'm already here)))

      pfSense plus 24.11 on Topton mini PC
      CPU: Intel N100
      NIC: Intel i-226v 4 pcs
      RAM : 16 GB DDR5
      Disk: 128 GB NVMe
      Brgds, Archi

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @Antibiotic
        last edited by johnpoz

        @Antibiotic I have no idea what your asking to be honest? Doesn't matter if home user or enterprise user - there are benefits to moving to kea.. But there is little point to do so currently unless your not using any of the features currently not implemented.

        If you are just handing out ips with no options and no need for any of the other integrations.. Have at it - I wouldn't spend any time writing anything.. Unless your going to submit to pfsense to be included because whatever you work up now, may or may not be viable as the integration into pfsense changes.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        A 1 Reply Last reply Reply Quote 1
        • A
          Antibiotic @johnpoz
          last edited by

          @johnpoz Foggy, but OK))) will wait

          pfSense plus 24.11 on Topton mini PC
          CPU: Intel N100
          NIC: Intel i-226v 4 pcs
          RAM : 16 GB DDR5
          Disk: 128 GB NVMe
          Brgds, Archi

          1 Reply Last reply Reply Quote 1
          • imark77I
            imark77 @johnpoz
            last edited by imark77

            @johnpoz wait what's wrong with windows 95 that's what I'm replying to from! Partially kidding but I do have a windows 98 virtual machine and a few of them.

            Yes going to have to update at some point and looks like we're gonna get some new features too.
            Although the flashing banner with no information Link really is a freak out like sky falling nuclear disaster global financial reset Global civil war conspiracy freak out.

            --
            In case anybody's wondering I disabled it, went back and now ALL systems are getting DHCP. So I don't know if I have a weird edge case. But I'm also noticing domain name resolution ( AP1.MyNet ) isn't working either now. But I can't necessarily confirm that with the new hardware as it was working with the old hardware and I can only think? that it was working with the new hardware but can't confirm my memory on that.

            1 Reply Last reply Reply Quote 0
            • A
              aligator638 @mwierowski
              last edited by aligator638

              @mwierowski I agree with you that netgate should tell us what is to be expected. For example I have AD dsn servers and non windows clients, since ISC DHCP was not GSS-TSIG, I had to implement some scripts to manually register these clients in DNS.

              Now with kea this is possible as the plugin exists out of the box:
              https://kea.readthedocs.io/en/latest/arm/integrations.html#gss-tsig

              The use case is simple, you have pfsense giving out addresses, to windows and linux clients and a separate dns server running on your AD , with ISC you are left off to have clients register themselves, which is not ideal.

              With Kea and the plugin DHCP will register the IPs in AD DNS, and life will be better ;-)

              Now when will this implemented ?

              Eric

              T 1 Reply Last reply Reply Quote 0
              • T
                thermo @aligator638
                last edited by

                @aligator638 GSS-TSIG is part of ISC's premium "enterprise" subscription, and not something Netgate can implement and hand out to everyone.

                cmcdonaldC 1 Reply Last reply Reply Quote 0
                • cmcdonaldC
                  cmcdonald Netgate Developer @thermo
                  last edited by cmcdonald

                  Progress update:

                  Unbound registration can be enabled/disabled for DHCP and DHCPv6 independently (yes this new integration supports v6). Updates occur asynchronously and never restart Unbound. In fact, enabling/disabling registration doesn't even restart Unbound. Instead, we work out what records need to be added/removed, make those changes via unbound-control and then write out a snippet of Unbound configuration that is used to "seed" Unbound with a set of lease records if Unbound is restarted for whatever reason.

                  We try several options for determining the domain name. In order of precedence:

                  1. domain-name option set in the response packet? (only applicable to v4)
                  2. first search domain set in the response packet? (the first option for v6)
                  3. finally, the system domain as a last resort

                  The record ttl is one-third the lifetime of the lease. So if the lease has a lifetime of 7200 seconds, the record ttl is 2400 seconds.

                  So if you have multiple address pools with different options, those leases could potentially have different domains used in the registration.

                  Note: These final UI details are subject to change

                  Here is the DHCPv4 global setting:
                  59a5580f-cf13-4d82-8ba1-834876827d67-image.png

                  Per-subnet overrides:
                  9a65d8e6-65d6-425a-bb68-0872d6717986-image.png

                  • Use server default tracks the server policy
                  • Enable unconditionally enables registration, regardless of default policy
                  • Disable ... does the obvious thing.

                  Need help fast? https://www.netgate.com/support

                  keyserK 1 Reply Last reply Reply Quote 5
                  • keyserK
                    keyser Rebel Alliance @cmcdonald
                    last edited by

                    @cmcdonald This is REALLY excellent Christian๐Ÿ™๐Ÿค˜Very good work and a simple/easy to understand UI to configure it.
                    Exactly what have been severely missing in the pfSense DNS solution for years โ™ฅ๏ธ

                    Love the no fuss of using the official appliances :-)

                    M 1 Reply Last reply Reply Quote 2
                    • M
                      mcury @keyser
                      last edited by

                      Hello, thanks for the hard work, it is getting awesome indeed =)

                      Let me ask,
                      Will be possible to run DHCP relay on one interface but not the other ?
                      I mean, run pfSense's DHCP for a guest VLAN and DHCP relay for another ?

                      dead on arrival, nowhere to be found.

                      keyserK cmcdonaldC 2 Replies Last reply Reply Quote 0
                      • keyserK
                        keyser Rebel Alliance @mcury
                        last edited by

                        @mcury Yeah, that would be a VERY nice feature indeed. ESPECIALLY if the DHCP relay could be brought to work properly with DHCP servers at the other end of IPSec S2S tunnels

                        Love the no fuss of using the official appliances :-)

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          mcury @keyser
                          last edited by

                          @keyser said in Kea DHCP Feature Roadmap:

                          @mcury Yeah, that would be a VERY nice feature indeed. ESPECIALLY if the DHCP relay could be brought to work properly with DHCP servers at the other end of IPSec S2S tunnels

                          I had to restore a laptop image through Synology ACB and I couldn't use PXE boot because of this.. The only way was to disable DHCP for all networks in pfSense, then use DHCP relay through the tunnel.

                          dead on arrival, nowhere to be found.

                          1 Reply Last reply Reply Quote 0
                          • cmcdonaldC
                            cmcdonald Netgate Developer @mcury
                            last edited by cmcdonald

                            @mcury I've explored this and actually made some pretty decent progress on it. Though, that was a year or two ago. Once I complete the Kea integration I will look into this again. It is something I too have wanted in pfSense.

                            Technically speaking, it is possible. However, the ISC dhcpd server and relay were not originally written with this use-case in mind. In fact, they share quite a bit of code. Along that same vein, the current dhcp relay in pfSense is still based on the EOL dhcpd code, so we are actively exploring alternatives here as well. One idea is to write a relay plugin for Kea and actually run the relay directly inside Kea. Another is to just write a new relay in something like Go. DHCP relaying isn't technically complicated, the hardest part is just parsing the packets. Everything else is just packet transforms. There is no active state to maintain as all the state needed to do DHCP relaying is self-contained in the DHCP packets themselves...so you could say DHCP relaying is a stateless operation from the perspective of the relay agent.

                            Regardless of the direction we choose, I will make sure that we can run DHCP server and relay simultaneously on the same box (albeit on different interfaces of course).

                            Need help fast? https://www.netgate.com/support

                            M 1 Reply Last reply Reply Quote 3
                            • M
                              mcury @cmcdonald
                              last edited by

                              @cmcdonald That would be great
                              Really thanks for all the efforts, if you need someone to help testing, just ping ๐Ÿ‘

                              dead on arrival, nowhere to be found.

                              1 Reply Last reply Reply Quote 1
                              • J
                                Jossk
                                last edited by

                                Sorry to revive an old thread. It's now 2025, with no updates.

                                @cmcdonald Is there a roadmap (even an unofficial, no hard dates)?

                                And/or a feature comparison.

                                Thanks

                                S imark77I 2 Replies Last reply Reply Quote 0
                                • S
                                  SteveITS Galactic Empire @Jossk
                                  last edited by

                                  @Jossk There was:
                                  https://docs.netgate.com/pfsense/en/latest/releases/24-11.html#general
                                  ...which links to:
                                  https://www.netgate.com/blog/improvements-to-kea-dhcp
                                  and:
                                  https://redmine.pfsense.org/issues/15650

                                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                  Upvote ๐Ÿ‘ helpful posts!

                                  1 Reply Last reply Reply Quote 0
                                  • imark77I
                                    imark77 @Jossk
                                    last edited by

                                    @Jossk noo no problem that's something I would do anyway. Good to have relevant information together.

                                    J 1 Reply Last reply Reply Quote 0
                                    • J
                                      Jossk @imark77
                                      last edited by

                                      @imark77 Thanks. As it stands, you have to do lots of digging around to see if feature parity matches your needs.

                                      Would give you an upvote if I could.

                                      1 Reply Last reply Reply Quote 2
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.