Kea DHCP Feature Roadmap

thermo

@aligator638 GSS-TSIG is part of ISC's premium "enterprise" subscription, and not something Netgate can implement and hand out to everyone.

cmcdonald

Progress update:

Unbound registration can be enabled/disabled for DHCP and DHCPv6 independently (yes this new integration supports v6). Updates occur asynchronously and never restart Unbound. In fact, enabling/disabling registration doesn't even restart Unbound. Instead, we work out what records need to be added/removed, make those changes via unbound-control and then write out a snippet of Unbound configuration that is used to "seed" Unbound with a set of lease records if Unbound is restarted for whatever reason.

We try several options for determining the domain name. In order of precedence:

domain-name option set in the response packet? (only applicable to v4)
first search domain set in the response packet? (the first option for v6)
finally, the system domain as a last resort

The record ttl is one-third the lifetime of the lease. So if the lease has a lifetime of 7200 seconds, the record ttl is 2400 seconds.

So if you have multiple address pools with different options, those leases could potentially have different domains used in the registration.

Note: These final UI details are subject to change

Here is the DHCPv4 global setting:

Per-subnet overrides:

Use server default tracks the server policy
Enable unconditionally enables registration, regardless of default policy
Disable ... does the obvious thing.

keyser

@cmcdonald This is REALLY excellent ChristianVery good work and a simple/easy to understand UI to configure it.
Exactly what have been severely missing in the pfSense DNS solution for years ️

mcury

Hello, thanks for the hard work, it is getting awesome indeed =)

Let me ask,
Will be possible to run DHCP relay on one interface but not the other ?
I mean, run pfSense's DHCP for a guest VLAN and DHCP relay for another ?

keyser

@mcury Yeah, that would be a VERY nice feature indeed. ESPECIALLY if the DHCP relay could be brought to work properly with DHCP servers at the other end of IPSec S2S tunnels

mcury

@keyser said in Kea DHCP Feature Roadmap:

@mcury Yeah, that would be a VERY nice feature indeed. ESPECIALLY if the DHCP relay could be brought to work properly with DHCP servers at the other end of IPSec S2S tunnels

I had to restore a laptop image through Synology ACB and I couldn't use PXE boot because of this.. The only way was to disable DHCP for all networks in pfSense, then use DHCP relay through the tunnel.

cmcdonald

@mcury I've explored this and actually made some pretty decent progress on it. Though, that was a year or two ago. Once I complete the Kea integration I will look into this again. It is something I too have wanted in pfSense.

Technically speaking, it is possible. However, the ISC dhcpd server and relay were not originally written with this use-case in mind. In fact, they share quite a bit of code. Along that same vein, the current dhcp relay in pfSense is still based on the EOL dhcpd code, so we are actively exploring alternatives here as well. One idea is to write a relay plugin for Kea and actually run the relay directly inside Kea. Another is to just write a new relay in something like Go. DHCP relaying isn't technically complicated, the hardest part is just parsing the packets. Everything else is just packet transforms. There is no active state to maintain as all the state needed to do DHCP relaying is self-contained in the DHCP packets themselves...so you could say DHCP relaying is a stateless operation from the perspective of the relay agent.

Regardless of the direction we choose, I will make sure that we can run DHCP server and relay simultaneously on the same box (albeit on different interfaces of course).

mcury

@cmcdonald That would be great
Really thanks for all the efforts, if you need someone to help testing, just ping

Jossk

Sorry to revive an old thread. It's now 2025, with no updates.

@cmcdonald Is there a roadmap (even an unofficial, no hard dates)?

And/or a feature comparison.

Thanks

SteveITS

@Jossk There was:
https://docs.netgate.com/pfsense/en/latest/releases/24-11.html#general
...which links to:
https://www.netgate.com/blog/improvements-to-kea-dhcp
and:
https://redmine.pfsense.org/issues/15650

imark77

@Jossk noo no problem that's something I would do anyway. Good to have relevant information together.

Jossk

@imark77 Thanks. As it stands, you have to do lots of digging around to see if feature parity matches your needs.

Would give you an upvote if I could.