Mastodawn

OPNSense's 26.1 release bumps radvd to include PREF64 support, which I've been anxiously expecting.

It also moves isc-dhcp to a plugin, pointing towards either Kea or dnsmasq.

So, that's the push I needed to finally move to Kea.

But, Kea in OPNSense doesn't have DHCP lease DNS registration tied in. Kea does support that with RFC 2136 registration, but it's not available directly in the OPNSense config.

So, the net effect is that Hugo is now completely revamping the home network DHCP and DNS setup, moving it from the OPNSense gateway to the couple of little mini PCs with Adguard + unbound + Knot for DNS, with HA Kea for DHCPv4.

And then I'll finish the OPNSense upgrade 😂

Oh hey; where did this yak and shears come from?

Show thread

Hugo Slabbert ⚠️Feb 1

kea is up with active/standby HA, and pools and options moved;

leases imported to keep a few things consistent across the move;

ISC dhcpd disabled and dhcrelay configured on opnsense;

DHCP scopes handing out the new Adguard endpoints for DNS;

kea is registering forward & reverse DNS with knot;

unbound is configured with stubs pointing at knot for the relevant zones;

Once we've got a critical mass of some DNS internal records registered to knot from DHCP renewals, I'll cut over AdGuard to point to unbound, to basically let things flow through the new paths.

Getting there!

Show thread

Keenan Tims Feb 1

@hugo Kinda surprised they're deprecating ISC without this feature tbh. It's been blocking me from moving to Kea too. ISTR there was another thing too. It might have just been that it wasn't possible to run Kea on some interfaces and ISC on others simultaneously. I probably have room on the home assistant k8s box to run DNS, I guess (which is alongside the opnsense VM). I don't really have any other 'reliable' machines to put it on. I don't really *want* to though. This is like table stakes basic stuff.

Accept a dependency on my public internet DNS and put it there maybe? Hmm.

Show thread

Hugo Slabbert ⚠️Feb 1

@ktims the answer seems to be that if you want DNS entries from DHCP to just use dnsmasq, with the language basically being that Kea is the option for more "advanced" deployments.

ISC isn't being totally deprecated in OPNSense yet, and they do appear to have something in place that if you upgrade from an earlier release and use ISC that the plugin is installed for you automatically. But, it does seem like the writing is on the wall.

For mixing and matching:
That might be possible? As I was switching, the ISC enablement is definitely per interface, as was dhcrelay, so I could move that an interface at a time. I'm not sure about the Kea side in OPNSense, but it does look from the docs to have a listening interface setting, as a well as an option to bypass the GUI config and just manage the config file manually.

Show thread

Keenan Tims

@hugo Fair enough I guess.

Both web UIs have configuration for selecting bind interfaces.

The problem is ISC listens on *:67 regardless of which interfaces it's enabled on so Kea can't bind the socket anywhere else. OpnSense does send the interface names on the dhcpd command line so I guess it's a limitation.

dhcpd    dhcpd      97009 12  udp4   *:67                  *:*

I thought maybe this was necessary to capture the broadcasts, but Kea itself only binds to the interface IP, so I suppose not.

Show thread

Hugo Slabbert ⚠️Feb 1

@ktims

The problem is ISC listens on *:67 regardless of which interfaces it's enabled on so Kea can't bind the socket anywhere else.

Ah, weird. I definitely had both ISC and dhcrelay active in my opnsense install on separate interfaces while messing around with things, and confirmed that functioning (test interface got relayed correctly).

But, I never got so far as a netstat to check there as things didn't block or throw any errors in the UI, and functioned as expected.

Show thread

Keenan Tims Feb 1

@hugo Ah maybe they fixed it? I haven't upgraded yet.

Kea gives:

failed to open socket: Failed to open socket on interface vtnet0_vlan6, reason: failed to bind fallback socket to address 10.6.6.1, port 67, reason: Address already in use - is another DHCP server running?

Show thread

Hugo Slabbert ⚠️Feb 1

@ktims weird, yea. I'm still on 25.7 at the moment. I did only flip to dhcrelay on OPNSense while ISC was still running on other interfaces, rather than Kea on OPNSense, but with that failure mode I would have assumed the issue is in ISC's binding, not something Kea is doing.

🤷