Does static mapping work in kea DHCP?
-
@Patch I have probably a hundred or close to that static reservations/mappings and using the KEA DHCP backend, so far that part seems to be working just fine.
-
Another quote from the thread previously linked-
@RobbieTT said in KEA DHCP - lacking features:Before it went live it was suggested that encouraging users to leave ISC for Kea was rather over done, considering its immaturity.
I did switch to Kea during the beta period and it was seamless with no apparent drawbacks but once I released some basics were missing and that it was relying on previous ISC managed data to function, had me switching back.
As I understand it, simple static mappings / reservations from Kea are not actually supported. However, it may give an illusion of functionality if you have run ISC previously. Existing mappings / reservations will still be resolvable as the hosts file still contains them as a hang-over from running ISC. Any new mappings added or modified will not be resolvable.
To me, the ability to set a static mapping / reservation is a basic cornerstone of networking. I think there will be a cascade of confusion as and when the previous hosts file becomes out-of-date.
️From this it would seem that any reservations added after switching to kea will fail.
-
@wgstarks I believe he is not talking about the reservations specifically, but the DNS resolution of those reservations:
Any new mappings added or modified will not be resolvable.
And I do confirm a couple of days after changing to KEA the resolution of local hosts stopped working. I added the relevant ones to the DNS resolver static mappings for now until this issue has been resolved.
-
@maverickws
If I add the mappings to DNS Resolver won't I also need to set a static address on each machine rather than the use DHCP setting I'm using now?Box: SG-4200
-
@wgstarks ok so the static mappings on the DHCP Server work.
You can set them as usual on the DHCP Server - Static Mappings and your clients will get the assigned addresses.But the issue and what happens right now is the DNS resolution for these mappings isn't working, so if you try to go only by the name you won't get nowhere.
Since you already have a mapping and you know that client is always getting that IP, by manually adding them to the DNS Resolver, it will help overcome this issue.
I am hoping in a next version it will be sorted and you won't need to have the static host overrides. It's just a temporary fix.
-
@maverickws
Ahhh ok, I think I understand now. So IP resolution will work fine (https://10.0.1.1) but name resolution (https://heimdall.local) will fail unless I use host override in DNS Resolver, right?Box: SG-4200
-
@wgstarks yup exactly
-
@wgstarks said in Does static mapping work in kea DHCP?:
set a static address on each machine
Noop.
No need to touch any of your networked devices.
That is : every device that add to your network : take a picture of the sticker that mentions the MAC.
Then go to pfSense and make this list longer :
I just added the MAC of a new device, was using KEA (I made the switch this morning), and the device got the IPv4 I specified - outside the DHCPv4 pool.
So, again : leave all device on 'DHCP' - no need to set a network, DNS, gateway etc on every device.
For the IPv6 lovers :
I tend to say : note also the DUID ..... but I've never saw a sticker mentioning that one
So : DHCP logs came to the recsue : connect the device, and have it atributed an IPv6 out of the IPv6 pool, from the DHCPv6 server.
Copy paste the DUID under the DHCPv6 lan server settings.
The same procedure as what has been done with the MAC under IPv4.
And done : have your device reconnect (rip ouit the cable a moment) your device now reconnect, using the (GUA) IPv6 you wanted it to have (don't care about the "fe80::4904:ee61:c85e:3bb4%9(prefered)" as humans shouldn't use that one anyway.About DNS :
When you add a item under
it will get added to this file /etc/hosts - please don't believe me, check for yourself :
Here is mine :127.0.0.1 localhost localhost.bhf.tld ::1 localhost localhost.bhf.tld 192.168.1.1 pfSense.bhf.tld pfSense 2a01:cb19:9xx:a6dc:92ec:77ff:fe29:392c pfSense.bhf.tld pfSense 192.168.1.2 bureau2.bhf.tld bureau2 192.168.1.3 TL-SG108E.bhf.tld TL-SG108E 192.168.1.4 poweredget310.bhf.tld poweredget310 192.168.1.6 gauche2.bhf.tld gauche2 192.168.1.7 droite.bhf.tld droite 192.168.1.8 dvr.bhf.tld dvr 192.168.1.11 bureau.bhf.tld bureau 192.168.1.16 ricoh.bhf.tld ricoh 192.168.1.17 clim.bhf.tld clim 192.168.1.18 liveradio.bhf.tld liveradio 192.168.1.23 kindle-f2051e0a8.bhf.tld kindle-f2051e0a8 .......When unbound starts, pfSense will create a (var/unbound/)unbound.conf file.
This file contains :... # Static host entries include: /var/unbound/host_entries.conf ....The unbound pfSense startup code will create this file (/var/unbound/host_entries.conf) from the /etc/hosts file.
Please, have a look at your /var/unbound/host_entries.conf
So, yes, local "DHCP Static Mappings" entries will make local host names known.
Proof of concept - dvr is a host name of one of my devices on my LAN :
C:\Users\Gertjan>ping dvr Envoi d’une requête 'ping' sur dvr.bhf.tld [2a01:cb19:9xx:a6dc::7f] avec 32 octets de données : Réponse de 2a01:cb19:9xx:a6dc::7f : temps=1 ms Réponse de 2a01:cb19:9xx:a6dc::7f : temps=1 ms Réponse de 2a01:cb19:9xx:a6dc::7f : temps=2 ms .... -
@wgstarks I've been finding that IP static mappings don't work properly either, if a dynamic address has already been assigned.
I had this issue with several IoT devices where I'd connect them to the network and then grab the MAC from they leases to add to a static entry, but after restarting they'd continue on with the same IP.
I thought this was an issue with the new firmware on those devices, but just today I had similar issues with a pi.When connecting via wifi, I can even release the IP on the pi but the leases continue to show the IP as active (which means I cannot release) and a new request gets offered the same IP, with KEA ignoring the static mapping. Only way to get the static to work is to wait for the dynamic address to expire.
-
@phormix said in Does static mapping work in kea DHCP?:
Only way to get the static to work is to wait for the dynamic address to expire.
That’s what I’ve been doing too.
-
@wgstarks I just switched back to ISC. Of course now that means the warnings about it being deprecated are front-and-center but KEA just feels like it's still beta quality
-
@phormix said in Does static mapping work in kea DHCP?:
KEA just feels like it's still beta quality
I mean, it literally is? "feature preview"
https://docs.netgate.com/pfsense/en/latest/releases/2-7-1.html#kea-dhcp-server-feature-preview-now-available -
@phormix said in Does static mapping work in kea DHCP?:
the warnings about it being deprecated
Well turn if off if you want... Its right there where you switch..
I mean, it literally is? "feature preview"
Exactly and a "preview" is not even alpha level normally.. A preview is like a taste of what is to come, but the artist really hasn't even started the painting yet... It's like the first rough sketch..
Think of it like this.. Kea currently is left
if your a windows users, think of it as the "canary" channel would be my take if you run the preview builds.
edit: here was my test of kea;
Well it hands out an IP, that's cool
Wow they need to spend some time on the logging - its horrible! ;)
Back to ISC.. -
@johnpoz you can, but here's the thing:
Redhat6 is deprecated. Windows XP is deprecated. SSLv3 is deprecated.
What do all of these things have in common? Well you shouldn't be using them, there's a newer solution that provides essentially the same function, and you really shouldn't be using the old one.
If ISC DHCP is deprecated, but KEA doesn't fill that gap. Per the ISC's posting, it's essentially "hey, this does all we need it to do and we don't want to introduce instability with significant feature changes, if you want those use KEA, but we will keep an eye for significant flaws in the old code and still potentially fix those"
I'd say messages stating ISC DHCP is deprecated may be dropped are not a great look, at least until KEA is more stable and robust. A better message would be that ISC DHCP no longer offers new features, and users are encouraged to try KEA (with some notes that bugs are still being printed out). Pushing people towards an unstable or feature -poor product with alarmist messaging is never a good idea.
So yeah, back to ISC it is for now
-
Not going to disagree that that wording could of been better..
Been a lot of threads where users fail to even read the release notes, and just click to switch because of the warning..
Like this one - nobody that read the release notes about all the stuff missing would think hey lets switch to kea now, unless they were running the most basic of setups with - hey hand out some IPs..
But on the other hand, most all the threads here are because someone fail to read the documentation in the first place ;)
-
@phormix
First off I agree the wording could have been way different. It came up here within days I think, and the answer was, essentially, ‘the note is correct, it will be removed, it doesn’t say anyone needs to use Kea.’ It’s led to unnecessary alarm, and confusion/frustration.Redhat6 is deprecated. Windows XP is deprecated. SSLv3 is deprecated.
I’m going to nitpick a bit but I see it a lot. Those aren’t deprecated those are discontinued and unsupported. I think the word has shifted in meaning over the years in common speech from “will be removed” to “past EOL” to “has been removed,” and they are using the former, original meaning. I tried to look it up to be specific and the definition seems to vary quite a bit around/between those.
If it was replaced they would replace it.
-
@SteveITS exactly.. Deprecated does not mean - hey stop using this, it no longer works, or there is a serious exploit ;)
-
Does anyone know if KEA DHCP integration to DNS Resolver will be fixed in 24.03 ? I would really want to migrate off of ISC.
As stated above, deprecated does not mean it is not available and is still stable. But deprecated software is a highly visible target for bad actors to start to find new vulnerabilities. Then heavily exploit it as deprecated means no more patching. There used to be a time that depricated meant no more licensing and minimal maintenance, it worked, you just left it alone. Not anymore, every security camp either ring fences software off the patch cycle or pushes to remove it all from the network.
-
@gauthig said in Does static mapping work in kea DHCP?:
highly visible target for bad actors to start to find new vulnerabilities.
Not going to disagree with you - but in what scenario would you dhcp server be exposed to "bad actors" in the first place?
Are there any known exploits that are of concern, ISC stated that if something does come up - its quite possible they would patch, etc. Its just really they are no longer going to be developing this product.. So its prob time to move on..
isc dhcp is a very stable and mature product..
-
@gauthig said in Does static mapping work in kea DHCP?:
Does anyone know if KEA DHCP integration to DNS Resolver will be fixed in 24.03 ? I would really want to migrate off of ISC.
Yes, of course.
We're all in the "Here is 23.09.1 (or 2.7.2), and we proudly present KEA" phase.
A minimum GUI parameter set is present, and as much as possible pfSense users out there can test drive KEA now.
If there are none or very view issues with the bare bone functionality : handing out IPv4 and IPv6 leases, then Netgate can continue with adding more 'KEA' options.All they need to do, is picking the right choices from here (
) and implementing them into the GUI.And adding/resolving the long overdue "Register DHCP leases / host names into the local DNS" issue.
