• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

KEA DHCP missing "Register DHCP leases in DNS Resolver..."

Scheduled Pinned Locked Moved DHCP and DNS
128 Posts 42 Posters 60.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    Slowmotion 0
    last edited by Feb 26, 2024, 9:31 PM

    Yeah, I resumed to ISC DHCP Server, and it is all fine now. Whatever.

    I think we all know the pitfall now, so anyone who wish to use local DNS for home devices (instead of just Apple Bonjour) should continue to use ISC DHCP instead. I agree that Netgate won't unplug it anytime soon, but a more meaningful depreciation message is highly desired (I can predict more pfSense fans fall into this email trap as time goes by).

    Corporate environment probably won't care as they will have their own DNS administration anyway.

    The answer would be 2-step,

    1. when KEA DHCP has something like ddns-update-on-renew option in future;
    2. when Netgate developers have time to integrate the future KEA DHCP with DNS Forwarder;

    There is nothing we can/need to do for now, and time will cure all bugs... 😃

    J 1 Reply Last reply Feb 28, 2024, 5:29 AM Reply Quote 0
    • J
      JonathanLee
      last edited by Feb 28, 2024, 5:28 AM

      I like KEA I have been testing it on and off. You get a lot of info in the logs with KEA too. I have read somewhere that ISC can have VLAN leaks into other subnets if an advanced attacker goes after this weak point. ISC even has some CVEs on it. KEA is suppose to be a more secure DHCP server. Anyone else get it to run correctly? I had some bad issues with my Layer 2 rules but it seemed to clean up this time around. I am not doing the whole KISS mindset here let's face it.

      Make sure to upvote

      1 Reply Last reply Reply Quote 0
      • J
        JonathanLee @Slowmotion 0
        last edited by Feb 28, 2024, 5:29 AM

        @Slowmotion-0 set some static leases for your Bonjour needs. I have one for my MFP device and it is accessible and has no issues with KEA

        Make sure to upvote

        P 1 Reply Last reply Mar 30, 2024, 7:43 PM Reply Quote 0
        • P
          pvk1 @JonathanLee
          last edited by Mar 30, 2024, 7:43 PM

          @JonathanLee
          I have 2 issues with KEA DHCP. One as mentioned, it breaks get DNS to work on the local LAN. The second, it broke DHCP as well. It took a while to discover it was not running. Starting it did not help The issue was you can't have a FQDN mentioned in the NTP setting.

          Both these need to be fixed before telling users they should move the DHCP server

          Q 1 Reply Last reply Mar 31, 2024, 9:33 AM Reply Quote 1
          • Q
            Qinn @pvk1
            last edited by Mar 31, 2024, 9:33 AM

            @pvk1 Do you have Service Watchdog installed and enabled on it?

            Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
            Firmware: Latest-stable-pfSense CE (amd64)
            Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

            P 1 Reply Last reply Mar 31, 2024, 10:57 AM Reply Quote 0
            • P
              pvk1 @Qinn
              last edited by pvk1 Mar 31, 2024, 10:59 AM Mar 31, 2024, 10:57 AM

              @Qinn No I don't. I just followed this
              f9497667-8536-4a6f-9561-ca8adb9c5f41-image.png
              It cost me a couple of hours as my wifi network went down.

              J 1 Reply Last reply Mar 31, 2024, 3:19 PM Reply Quote 0
              • J
                JonathanLee @pvk1
                last edited by Mar 31, 2024, 3:19 PM

                @pvk1 have you ran pkg update and updated unbound that might fix the restart issues. My system is fine with kea.

                Make sure to upvote

                P 1 Reply Last reply Mar 31, 2024, 4:21 PM Reply Quote 0
                • P
                  pvk1 @JonathanLee
                  last edited by Mar 31, 2024, 4:21 PM

                  @JonathanLee
                  Thx I have ran pkg update, but it did not change it.

                  If you have an fqdn in the DHCP settings and you switch to KEA, it won't start:

                  0d53a61f-2276-47c2-ae68-cf5215ac0a7c-image.png

                  After changing it to an IP address it worked. See https://redmine.pfsense.org/issues/14991

                  But I found that the DNS Resolver does not get the DHCP devices, so it is of no use to me. I will switch over when this is fixed.

                  It is explained here. That is fine for me, but that banner telling people to move to it would have better be left out

                  https://docs.netgate.com/pfsense/en/latest/releases/23-09.html#kea-dhcp-server-feature-preview-now-available

                  N 1 Reply Last reply Mar 31, 2024, 7:52 PM Reply Quote 0
                  • J
                    JonathanLee
                    last edited by JonathanLee Mar 31, 2024, 8:27 PM Mar 31, 2024, 5:14 PM

                    Mine works that is weird, again I use authentication for my NTP, but that is IP based not a FQDN, what if you just found the IP of the FQDN and used that?

                    https://forum.netgate.com/topic/162746/authenicated-ntp

                    Make sure to upvote

                    1 Reply Last reply Reply Quote 0
                    • N
                      noloader @pvk1
                      last edited by Mar 31, 2024, 7:52 PM

                      @pvk1 said in KEA DHCP missing "Register DHCP leases in DNS Resolver...":

                      If you have an fqdn in the DHCP settings and you switch to KEA, it won't start:

                      0d53a61f-2276-47c2-ae68-cf5215ac0a7c-image.png

                      After changing it to an IP address it worked. See https://redmine.pfsense.org/issues/14991

                      But I found that the DNS Resolver does not get the DHCP devices, so it is of no use to me. I will switch over when this is fixed.

                      In your image, you only show two time servers. You have to use three or more time servers. Or that's how it used to work.

                      With 2 time servers, the client does not know which is correct. 3 or more allows the client to determine a "bad ticker" from "time keepers."

                      And keep in mind, that dialog asks for servers and not pools. So be sure to specify individual servers, and not pools.

                      J P 2 Replies Last reply Mar 31, 2024, 8:02 PM Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator @noloader
                        last edited by johnpoz Mar 31, 2024, 8:03 PM Mar 31, 2024, 8:02 PM

                        @noloader said in KEA DHCP missing "Register DHCP leases in DNS Resolver...":

                        You have to use three or more time servers. Or that's how it used to work.

                        that is never how it worked.. It might of defaulted to having 3 different pool addresses in pfsense general setup, not in dhcpd settings. But there is nothing saying you need more than 1. I only have 1, my local time server.

                        with isc dhcpd it resolves to place the IP into the dhcpd scope.. You can not hand out anything via dhcp other than IP. But the new kea preview does not resolve that fqdn you place in there..

                        The pool comment is pretty valid, because a pool address will normally return way more than 1 IP.. And dhcp can only hand out 1 IP per entry.. To be honest with a mistake to ever allow putting fqdn in there.. dhcp requires and IP.. Letting users think they could just put in a fqdn was not a good idea.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        N 1 Reply Last reply Mar 31, 2024, 8:10 PM Reply Quote 0
                        • N
                          noloader @johnpoz
                          last edited by Mar 31, 2024, 8:10 PM

                          @johnpoz said in KEA DHCP missing "Register DHCP leases in DNS Resolver...":

                          You have to use three or more time servers. Or that's how it used to work.
                          

                          that is never how it worked...

                          As far as I know, that is how NTP clients have always worked. See https://support.ntp.org/Support/SelectingOffsiteNTPServers#Upstream_Time_Server_Quantity.

                          But there's no telling what some internet entrepreneur is doing nowadays.

                          J 1 Reply Last reply Mar 31, 2024, 8:12 PM Reply Quote 0
                          • J
                            johnpoz LAYER 8 Global Moderator @noloader
                            last edited by johnpoz Mar 31, 2024, 8:14 PM Mar 31, 2024, 8:12 PM

                            @noloader that has nothing to do with the ntp settings in the dhcpd settings... By default there is nothing in there.. Shoot most clients don't ever use those even if you hand them out.

                            Don't confuse ntp inner working with a completely different thing dhcpd..

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • P
                              pvk1 @noloader
                              last edited by Mar 31, 2024, 9:29 PM

                              @noloader You are taking this too far. I just pasted an FQDN in to give an example. Try it out yourself with a NTP server FQDN. It will allow you to enter it, but KEA won't start. The workaround is to put a IP address in there.

                              GertjanG 1 Reply Last reply Apr 1, 2024, 6:06 AM Reply Quote 1
                              • GertjanG
                                Gertjan @pvk1
                                last edited by Apr 1, 2024, 6:06 AM

                                @pvk1

                                Yep. The KEA documentation - and for that matter, ISC DHCP states :
                                NTP name server fields in are 'IP' - not a host name.
                                The DHCP server KEA and ISC DHCP are not going tot resolve that host name. The DHCP RFC says : NTP servers are 'IP', not a host name.
                                Here you can see what a DHCP server should hand over to a client : rfc2132 => that's IPv4 addresses.
                                The pfSense GUI help message is :

                                390233df-ab5a-4795-b7b4-c7cd9bbe67b7-image.png

                                and is plain wrong. It's just a IP, no a host name, and even less a pool.

                                I guess ISC DHCP silently ignored it as a NTP host name was given, KEA just bails out with a log-error message.

                                Going even further :
                                I've got several Windows based PCs here, a version 7, a 10 and several 11 : none are using the NTP server IP (192.168.1.1) that came with DHCP ...
                                My iPhone, Pad etc : same thing.
                                Androids : let me guess ^^

                                I'm not even sure why I've set this NTP field. Maybe it will work some day.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                V P 2 Replies Last reply Apr 1, 2024, 6:22 AM Reply Quote 1
                                • V
                                  Vollans @Gertjan
                                  last edited by Apr 1, 2024, 6:22 AM

                                  @Gertjan said in KEA DHCP missing "Register DHCP leases in DNS Resolver...":

                                  I'm not even sure why I've set this NTP field. Maybe it will work some day.

                                  You’d think after over 20 years we’d just give up on the idea of anyone ever taking it up. ;)

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pvk1 @Gertjan
                                    last edited by pvk1 Apr 1, 2024, 8:12 AM Apr 1, 2024, 8:10 AM

                                    @Gertjan That is all correct, but not the point.

                                    The point is that the banner suggests that you should go to System > Advanced > Networking and switch DHCP backend. It should have pointed to a explanation page with the current limitations, because as it is people waste a lot of time.

                                    22f22422-573a-45e4-a05e-6b5e52f7327e-image.png

                                    Also both the ISC and the KEA page let you enter a FDQN without a warning. KEA brakes on a FDQN, ISC does not.

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      nvdx
                                      last edited by Apr 11, 2024, 11:55 PM

                                      I've made a special script that is called via Kea's hooks and live update unbound on each kea's lease update via unbound-control:
                                      https://github.com/nvandamme/kea-lease-unbound-control

                                      As i'm not an sh guru, feel free to make any pull requests !

                                      Cheers

                                      GertjanG 1 Reply Last reply Apr 12, 2024, 6:30 AM Reply Quote 3
                                      • GertjanG
                                        Gertjan @nvdx
                                        last edited by Gertjan Apr 12, 2024, 6:32 AM Apr 12, 2024, 6:30 AM

                                        @nvdx

                                        Oho !
                                        (something very like) This is all that Kea needs so it can register a host name into "unbound" as soon as it comes in.

                                        👍

                                        Question :

                                        bc2240fa-cdcb-4627-9d6e-2dba6d499c32-image.png

                                        shouldn't that be :

                                        UNBOUND_CONTROL_PATH="/usr/local/sbin/unbound-control"
                                        UNBOUND_CONFIG_PATH="/var/unbound/unbound.conf"
                                        

                                        ?

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        J N 2 Replies Last reply Apr 12, 2024, 7:05 AM Reply Quote 0
                                        • J
                                          JonathanLee @Gertjan
                                          last edited by Apr 12, 2024, 7:05 AM

                                          @Gertjan that dependent on plus version isn’t it?

                                          Make sure to upvote

                                          GertjanG 1 Reply Last reply Apr 12, 2024, 7:32 AM Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received