Can pfSense's DHCP server update Microsoft DNS?

johnpoz

Your clients will update the SOA of the domain.. Have them do that..

layla

@johnpoz Though, you STILL didn't answer the actual other question about "which keys are supposed to be used in this approach" I'll answer that here for future people on the internet, since this forum is supposed to be useful and provide answers:

This page answers the question of where the key comes from (e.g. on Linux with bind9) and how to generate it and apply it:
https://archyslife.blogspot.com/2018/02/dynamic-dns-with-bind-and-isc-dhcp.html

And this page answers the question w.r.t. PowerDNS:
https://doc.powerdns.com/authoritative/dnsupdate.html

Even if Microsoft DNS doesn't support the secure key, it should still support insecure updates, so I'm going to keep trying to understand what is needed to make dhcpd and Microsoft DNS communicate in that scenario. Unfortunately here be dragons because it seems either not documented or nearly impossible to find with a google/duckduckgo search.

layla

@johnpoz Linux clients don't do that by default. I presume you suggest that I should join all of my Linux clients to the domain? But that's part of the thing - I don't want to join hundreds of Linux servers to the AD DS domain (first and foremost because it's a pain to do, and not easily scalable, and second because it involves installing a lot of extra software [samba, kerberos, etc.] on the linux machines which I don't really want them to have). I just want DNS to know about them, but for them to stay otherwise in a separate Linux universe.

See the issue? It should be solvable via RFC 2136 via a DHCP server - but it does not seem documented how (unless you're using an Microsoft DNS server, and then it is documented how - at this link: https://ephemeralelectrons.wordpress.com/2017/07/19/dynamic-registration-of-dns-for-linux-devices-in-an-active-directory-environment-with-windows-dns-server/).

layla

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-ddns

@layla This article from Azure documents how to do secure updates with bind9 and MS DNS using the linux version of nsupdate (the using -g with the keys mentioned above for bind9 and -k with kerberos for MS DNS (though again, this goes back to basically enrolling into the domain for the MS DNS case.)

It also talks about insecure updates from linux directly with nsupdate during ifup/ifdown via scripting. This could sort of work, but it's so much less elegant to modify hundreds of linux machines (particularly where they need to be changed in different ways because e.g. Ubuntu 18.04 LTS does things differently than Ubuntu 20.04 LTS, etc.)...

So again, if nsupdate can do it (insecurely), why can't dhcpd? It sure seems like it should be possible. But does seem not documented... :/

slm

This tutorial seems like pretty much what you're looking for with an external DNS server being told about DHCP lease IPs + names - https://freeipa-users.redhat.narkive.com/xJVbXRdO/pfsense-dhcp-to-ipa-s-bind-dynamic-updates-success.

helviojr

@layla I know this is old, but could you come up with a solution. I made some research here, hoping one could configure Windows DNS server to accept unsecure update from just one source. That would help a little, as long as pfSense could send unsecure updates on behalf of the clients (I'm not sure it can). Anyway, it seems we can't limit that in Windows.

On the other hand, it would be interesting if we could configure those DNS Domain Key and DNS Domain Key Secret on Windows DNS Server. It seems it is a no go, also, right?

helviojr

I just saw the new KEA DHCP server implementation doesn't even have the DNS update feature. The KEA has a separate daemon for that, the DHCP-DDNS server. I'm not sure if it is available for pfSense (the package list is not being updated on my systems right now). I know it can do unsecure updates.

Gertjan

@helviojr

The "25.07.1" (and probably 2.8.1) Kea can do 'DDNS' just fine. Everything is already there, it's just not yet made avaible in the pfSense GUI.

You want to read this : ISC DHCP Dynamic DNS feature and Kea DHCP where I demonstrated a IPv6 DDNS update. I was updating against a "bind9 domain name server".
It worked pretty well, although I was only updating IPv6 IPs, as updating IPv4 RFC1918 (!) IPs into the domain name server doesn't make any sense ^^
Just remember : if you reboot your pfSense you have to start the kea-ddns process manually. The config files aren't touched by pfSense.

edit : instead of editing 'system files' as suggested in the thread mentioned, you can now use :

to add the needed dhcp(v6) extra config settings.

helviojr

@Gertjan Thank you. I see KEA is in implementing process yet. I miss the custom DHCP options that would be very helpful. I could do it hard-coded in the config generation script, but I'm sure it will be available in GUI soon enough.

On the DDNS, I actually was looking for Windows AD DNS update, but it seems it lacks of a way to set custom authentication keys or ACLs to permit specific non secure updates, and I cannot change it to accept insecure updates globally, of course. So I'll keep the DDNS on hold for now.

Gertjan

@helviojr said in Can pfSense's DHCP server update Microsoft DNS?:

I miss the custom DHCP options that would be very helpful. I could do it hard-coded in the config generation script, but I'm sure it will be available in GUI soon enough.

Which DHCP option ?
Read again the page where ISC announced they stopped the famous 'dhcp' project, and restarted form scratch, rebuilding the DHCP server again.
On the non-official page you'll find the reason : over the years, options were added. thousands of them. Some were written, debugged, and stable since. Some were changing all the time. Hardware vendors didn't stop adding and modifying them ....
It had became a software-maintenance hell.
( a bit like the openvpn project, or have a look at the absolute champion : postfix - or the black angel, freeradius : that one is just frighting).

So, they created a framework and a manual, and left it up to 'us' the user (a very special user : it's us, the admin users, so we need to admin stuff ones in a while, and this includes type in stuff) to know what option data is needed, and place it in a nice JSON format (yet another text file format with a very precis syntax, probably more strict as XML), test it ... and forget it.
Believe me : it isn't that hard ....
A (pfSense) GUI facility for every option would be best, of course, but I don't think Netgate will fall in this rabbit hole.

Writing a GUI (pfSense or not) that handles all the DHCP option ? (and does all the verification and checking of consistency etc ..) ... you might be waiting a long time.

Right now, imho, the kea v4 and v6 pfSense implementation is rock solid.
Some support for DNS registration, static leases and even HA is possible.
The option I needed were - surprise - asked in pfSense redmine, and examples were proposed. From there on, as I sa working examples, I made some of my own.

Anyway, I know, I'm rambling a bit. Just saying : you can do it ^^