Does static mapping work in kea DHCP?

wgstarks

@maverickws
If I add the mappings to DNS Resolver won't I also need to set a static address on each machine rather than the use DHCP setting I'm using now?

maverickws

@wgstarks ok so the static mappings on the DHCP Server work.
You can set them as usual on the DHCP Server - Static Mappings and your clients will get the assigned addresses.

But the issue and what happens right now is the DNS resolution for these mappings isn't working, so if you try to go only by the name you won't get nowhere.

Since you already have a mapping and you know that client is always getting that IP, by manually adding them to the DNS Resolver, it will help overcome this issue.

I am hoping in a next version it will be sorted and you won't need to have the static host overrides. It's just a temporary fix.

wgstarks

@maverickws
Ahhh ok, I think I understand now. So IP resolution will work fine (https://10.0.1.1) but name resolution (https://heimdall.local) will fail unless I use host override in DNS Resolver, right?

maverickws

@wgstarks yup exactly

Gertjan

@wgstarks said in Does static mapping work in kea DHCP?:

set a static address on each machine

Noop.
No need to touch any of your networked devices.
That is : every device that add to your network : take a picture of the sticker that mentions the MAC.
Then go to pfSense and make this list longer :

I just added the MAC of a new device, was using KEA (I made the switch this morning), and the device got the IPv4 I specified - outside the DHCPv4 pool.

So, again : leave all device on 'DHCP' - no need to set a network, DNS, gateway etc on every device.

For the IPv6 lovers :
I tend to say : note also the DUID ..... but I've never saw a sticker mentioning that one
So : DHCP logs came to the recsue : connect the device, and have it atributed an IPv6 out of the IPv6 pool, from the DHCPv6 server.
Copy paste the DUID under the DHCPv6 lan server settings.
The same procedure as what has been done with the MAC under IPv4.
And done : have your device reconnect (rip ouit the cable a moment) your device now reconnect, using the (GUA) IPv6 you wanted it to have (don't care about the "fe80::4904:ee61:c85e:3bb4%9(prefered)" as humans shouldn't use that one anyway.

About DNS :

When you add a item under

it will get added to this file /etc/hosts - please don't believe me, check for yourself :
Here is mine :

127.0.0.1	localhost localhost.bhf.tld
::1	localhost localhost.bhf.tld
192.168.1.1	pfSense.bhf.tld pfSense
2a01:cb19:9xx:a6dc:92ec:77ff:fe29:392c	pfSense.bhf.tld pfSense
192.168.1.2	bureau2.bhf.tld bureau2
192.168.1.3	TL-SG108E.bhf.tld TL-SG108E
192.168.1.4	poweredget310.bhf.tld poweredget310
192.168.1.6	gauche2.bhf.tld gauche2
192.168.1.7	droite.bhf.tld droite
192.168.1.8	dvr.bhf.tld dvr
192.168.1.11	bureau.bhf.tld bureau
192.168.1.16	ricoh.bhf.tld ricoh
192.168.1.17	clim.bhf.tld clim
192.168.1.18	liveradio.bhf.tld liveradio
192.168.1.23	kindle-f2051e0a8.bhf.tld kindle-f2051e0a8
.......

When unbound starts, pfSense will create a (var/unbound/)unbound.conf file.
This file contains :

...
# Static host entries
include: /var/unbound/host_entries.conf
....

The unbound pfSense startup code will create this file (/var/unbound/host_entries.conf) from the /etc/hosts file.

Please, have a look at your /var/unbound/host_entries.conf

So, yes, local "DHCP Static Mappings" entries will make local host names known.

Proof of concept - dvr is a host name of one of my devices on my LAN :

C:\Users\Gertjan>ping dvr

Envoi d’une requête 'ping' sur dvr.bhf.tld [2a01:cb19:9xx:a6dc::7f] avec 32 octets de données :
Réponse de 2a01:cb19:9xx:a6dc::7f : temps=1 ms
Réponse de 2a01:cb19:9xx:a6dc::7f : temps=1 ms
Réponse de 2a01:cb19:9xx:a6dc::7f : temps=2 ms
....

phormix

@wgstarks I've been finding that IP static mappings don't work properly either, if a dynamic address has already been assigned.

I had this issue with several IoT devices where I'd connect them to the network and then grab the MAC from they leases to add to a static entry, but after restarting they'd continue on with the same IP.
I thought this was an issue with the new firmware on those devices, but just today I had similar issues with a pi.

When connecting via wifi, I can even release the IP on the pi but the leases continue to show the IP as active (which means I cannot release) and a new request gets offered the same IP, with KEA ignoring the static mapping. Only way to get the static to work is to wait for the dynamic address to expire.

wgstarks

@phormix said in Does static mapping work in kea DHCP?:

Only way to get the static to work is to wait for the dynamic address to expire.

That’s what I’ve been doing too.

phormix

@wgstarks I just switched back to ISC. Of course now that means the warnings about it being deprecated are front-and-center but KEA just feels like it's still beta quality

SteveITS

@phormix said in Does static mapping work in kea DHCP?:

KEA just feels like it's still beta quality

I mean, it literally is? "feature preview"
https://docs.netgate.com/pfsense/en/latest/releases/2-7-1.html#kea-dhcp-server-feature-preview-now-available

johnpoz

@phormix said in Does static mapping work in kea DHCP?:

the warnings about it being deprecated

Well turn if off if you want... Its right there where you switch..

I mean, it literally is? "feature preview"

Exactly and a "preview" is not even alpha level normally.. A preview is like a taste of what is to come, but the artist really hasn't even started the painting yet... It's like the first rough sketch..

Think of it like this.. Kea currently is left

if your a windows users, think of it as the "canary" channel would be my take if you run the preview builds.

edit: here was my test of kea;

Well it hands out an IP, that's cool
Wow they need to spend some time on the logging - its horrible! ;)
Back to ISC..

phormix

@johnpoz you can, but here's the thing:

Redhat6 is deprecated. Windows XP is deprecated. SSLv3 is deprecated.

What do all of these things have in common? Well you shouldn't be using them, there's a newer solution that provides essentially the same function, and you really shouldn't be using the old one.

If ISC DHCP is deprecated, but KEA doesn't fill that gap. Per the ISC's posting, it's essentially "hey, this does all we need it to do and we don't want to introduce instability with significant feature changes, if you want those use KEA, but we will keep an eye for significant flaws in the old code and still potentially fix those"

I'd say messages stating ISC DHCP is deprecated may be dropped are not a great look, at least until KEA is more stable and robust. A better message would be that ISC DHCP no longer offers new features, and users are encouraged to try KEA (with some notes that bugs are still being printed out). Pushing people towards an unstable or feature -poor product with alarmist messaging is never a good idea.

So yeah, back to ISC it is for now

johnpoz

@phormix

Not going to disagree that that wording could of been better..

Been a lot of threads where users fail to even read the release notes, and just click to switch because of the warning..

Like this one - nobody that read the release notes about all the stuff missing would think hey lets switch to kea now, unless they were running the most basic of setups with - hey hand out some IPs..

But on the other hand, most all the threads here are because someone fail to read the documentation in the first place ;)

SteveITS

@phormix
First off I agree the wording could have been way different. It came up here within days I think, and the answer was, essentially, ‘the note is correct, it will be removed, it doesn’t say anyone needs to use Kea.’ It’s led to unnecessary alarm, and confusion/frustration.

Redhat6 is deprecated. Windows XP is deprecated. SSLv3 is deprecated.

I’m going to nitpick a bit but I see it a lot. Those aren’t deprecated those are discontinued and unsupported. I think the word has shifted in meaning over the years in common speech from “will be removed” to “past EOL” to “has been removed,” and they are using the former, original meaning. I tried to look it up to be specific and the definition seems to vary quite a bit around/between those.

If it was replaced they would replace it.

johnpoz

@SteveITS exactly.. Deprecated does not mean - hey stop using this, it no longer works, or there is a serious exploit ;)

gauthig

Does anyone know if KEA DHCP integration to DNS Resolver will be fixed in 24.03 ? I would really want to migrate off of ISC.

As stated above, deprecated does not mean it is not available and is still stable. But deprecated software is a highly visible target for bad actors to start to find new vulnerabilities. Then heavily exploit it as deprecated means no more patching. There used to be a time that depricated meant no more licensing and minimal maintenance, it worked, you just left it alone. Not anymore, every security camp either ring fences software off the patch cycle or pushes to remove it all from the network.

johnpoz

@gauthig said in Does static mapping work in kea DHCP?:

highly visible target for bad actors to start to find new vulnerabilities.

Not going to disagree with you - but in what scenario would you dhcp server be exposed to "bad actors" in the first place?

Are there any known exploits that are of concern, ISC stated that if something does come up - its quite possible they would patch, etc. Its just really they are no longer going to be developing this product.. So its prob time to move on..

isc dhcp is a very stable and mature product..

Gertjan

@gauthig said in Does static mapping work in kea DHCP?:

Does anyone know if KEA DHCP integration to DNS Resolver will be fixed in 24.03 ? I would really want to migrate off of ISC.

Yes, of course.
We're all in the "Here is 23.09.1 (or 2.7.2), and we proudly present KEA" phase.
A minimum GUI parameter set is present, and as much as possible pfSense users out there can test drive KEA now.
If there are none or very view issues with the bare bone functionality : handing out IPv4 and IPv6 leases, then Netgate can continue with adding more 'KEA' options.

All they need to do, is picking the right choices from here ( ) and implementing them into the GUI.

And adding/resolving the long overdue "Register DHCP leases / host names into the local DNS" issue.

maverickws

Definitely
Apart from the DNS resolution issue, everything else been running just fine with KEA.

johnpoz

@maverickws said in Does static mapping work in kea DHCP?:

everything else been running just fine with KEA.

Yeah it hands out IPs ;) And to be honest, I bet you there are lots and lots of users that have moved over and not noticed anything different.. Their devices get Ips, they renew the lease, etc..

There are many scenarios where it would work just fine I am sure.. Which is why they prob released it "early" if you will.. And put up the notice, hey move over to kea, isc is going away. Because most likely for your typical user - won't even notice it switched over..

To be honest, other than I am not a fan of the current logging, this could use some polish for sure - I could prob switch over to it.. Not much work to just setup host overrides for your devices vs using dhcp reservation registration..

I do hand out some options - but could live without those most likely.

But what you almost exclusively see on forums about product X, is something not working.. You don't see floods of hey works great!!

So yeah, whenever anything changes in product be it good/bad or just "change" you get more posts - quite often from people that just didn't read the docs on what is new or what changed or what is being removed, etc..

I wouldn't expect a flood of posts, hey I moved over to kea - it works just like isc did - why the mention of "preview" ;)

Maybe I missed some posts, but most of the ones I have seen = didn't read the blog post, nor the release notes or just didn't catch or understand what "preview" means ;) Or took hey isc is going away at some future time to mean they "had" to move now or all hell would break loose and the sky would fall ;) And they wouldn't never get a chance to move later and their whole network would come crashing down..

Others just didn't like the warning ;) and didn't notice they could turn it off.. And only way to make the warning go away was switch..

maverickws

@johnpoz well I am definitely missing the name resolution part, I have approximately 1 hundred devices including the smart home stuff, I really don't feel like having to register as host overrides is something that doesn't make any sense to me.
Not only here in my homelab but for example professionally we do have pfSense as well, after creating a fixed lease for a machine being provisioned we do rely heavily on the firewalls name resolving capacity, and wouldn't be feasible to have to register hosts manually for DNS.

But anyway as you very well stressed this is a preview, I got KEA running at home, when these issues are overcome we will also adopt on the other instances.