KEA DHCP missing "Register DHCP leases in DNS Resolver..."

[Gertjan]

@pvk1

Yep. The KEA documentation - and for that matter, ISC DHCP states :
NTP name server fields in are 'IP' - not a host name.
The DHCP server KEA and ISC DHCP are not going tot resolve that host name. The DHCP RFC says : NTP servers are 'IP', not a host name.
Here you can see what a DHCP server should hand over to a client : rfc2132 => that's IPv4 addresses.
The pfSense GUI help message is :

and is plain wrong. It's just a IP, no a host name, and even less a pool.

I guess ISC DHCP silently ignored it as a NTP host name was given, KEA just bails out with a log-error message.

Going even further :
I've got several Windows based PCs here, a version 7, a 10 and several 11 : none are using the NTP server IP (192.168.1.1) that came with DHCP ...
My iPhone, Pad etc : same thing.
Androids : let me guess ^^

I'm not even sure why I've set this NTP field. Maybe it will work some day.

[Vollans]

@Gertjan said in KEA DHCP missing "Register DHCP leases in DNS Resolver...":

I'm not even sure why I've set this NTP field. Maybe it will work some day.

You’d think after over 20 years we’d just give up on the idea of anyone ever taking it up. ;)

[pvk1]

@Gertjan That is all correct, but not the point.

The point is that the banner suggests that you should go to System > Advanced > Networking and switch DHCP backend. It should have pointed to a explanation page with the current limitations, because as it is people waste a lot of time.

Also both the ISC and the KEA page let you enter a FDQN without a warning. KEA brakes on a FDQN, ISC does not.

[nvdx]

I've made a special script that is called via Kea's hooks and live update unbound on each kea's lease update via unbound-control:
https://github.com/nvandamme/kea-lease-unbound-control

As i'm not an sh guru, feel free to make any pull requests !

Cheers

[Gertjan]

@nvdx

Oho !
(something very like) This is all that Kea needs so it can register a host name into "unbound" as soon as it comes in.

Question :

shouldn't that be :

UNBOUND_CONTROL_PATH="/usr/local/sbin/unbound-control"
UNBOUND_CONFIG_PATH="/var/unbound/unbound.conf"

?

[JonathanLee]

@Gertjan that dependent on plus version isn’t it?

[Gertjan]

@JonathanLee

Noop.
pfSense Plus and CE are very, like a lot, identical, when it comes to these kind of details.
IMHO, Plus and CE have a common build source base.
Plus has some value added packages added, and some low level stuff that permits it to run on Azure.
Plus has also ZFS file system kernel module loaded, so it can use ZFS as an option.
Things like that.
Core functionalities like "DNS", or "DHCP", are the same.

[nvdx]

@Gertjan
The example given is not matching pfsense specificaly.
For pfsense, of course, You're entirely right.
For other OSes, depends on the standard path of un
bound and kea's installation.
I'll add an example file for pfSense along the provided patch.

[JonathanLee]

@Gertjan Yes again CE starts with a different subfolder over Plus I think patches show a different root folder

[Vollans]

@Gertjan said in KEA DHCP missing "Register DHCP leases in DNS Resolver...":

Plus has also ZFS file system kernel module loaded, so it can use ZFS as an option.

As does CE. Plus has the tools for managing the ZFS system via the front end included, though, as a Plus.

[Qinn]

Maybe install System_Patches, there are 2 Kea patches and 2 DNS resolver.

[4o4rh]

@Qinn how do you find these two patches

[SteveITS]

@4o4rh
https://docs.netgate.com/pfsense/en/latest/development/system-patches.html

Also of note, since the security notes are not yet in the 23.04 release notes:
https://forum.netgate.com/topic/187622/system-patches-package-v2-2-10_1

[Qinn]

@4o4rh as @SteveITS already posted the answer, install system patches, then go to System -> Patches and apply them. More to read here https://www.netgate.com/blog/using-pfsense-software-system-patches .

[4o4rh]

@Qinn doesn't really answer the question. Where do we get a list of the patches available and what they are for?

[Qinn]

Install this package, you see a list recommended system patches for Netgate pfSense and for each patch there is a description what it does or do. After you installed the package see this list and you can choose to apply each one of them individually (even revert most of them if you for some reason want to) or change nothing and remove the whole package, as in the link above this package is recommended by Netgate.

[4o4rh]

@Qinn no recommendations

[SteveITS]

@4o4rh what version are you on? 24.03 has none because their code is included.

Typically patches appear either a few weeks/months after a release, to fix bugs, or else they dropped a bunch of them for 2.7.2/23.09 after 24.03 was released because there are security fixes they backported for 2.7:2,
https://forum.netgate.com/topic/187622/system-patches-package-v2-2-10_1

Patches appear after the package is updated not on their own.

[Qinn]

Same question here ;)

Btw I am on 2.7.2 CE ( as is in my signature) and use System_Patches v2.2.10_1, updated recently, say last week and as you can see patches are sane to install, as like this example https://redmine.pfsense.org/issues/14991 is target for the not released pfSense version 2.8.0

[2.7.2-RELEASE][root@pfSense.localdomain]/root: pkg info pfSense-pkg-System_Patches-2.2.10_1
pfSense-pkg-System_Patches-2.2.10_1
Name           : pfSense-pkg-System_Patches
Version        : 2.2.10_1
Installed on   : Wed Apr 24 10:50:01 2024 CEST
Origin         : sysutils/pfSense-pkg-System_Patches
Architecture   : FreeBSD:14:amd64
Prefix         : /usr/local
Categories     : sysutils

[maphilli14]

I somehow got burned by this too. No, I do not read release notes, I just trust that the latest and greatest firmware protects my family's network. I had some performance issues on my ISP so rebooted everything to try to fix and it took me several hours to get to a root cause. I am sad, but happy to have it all back up and running nicely. Next time I will be more leery!