DHCP / DNS Setup
Outdated
I have moved my DNS and DHCP servers to Docker, Docker-DNS Server. I am still using ISC_Bind9, but am now using ISC_Kea for DHCP as ISC_Bind is no longer supported as of 2022.
tl;dr;
Further to this I am no looking at backups for both these services on my local area network. Whilst these services worked reliably well, when ever I shutdown the the router with DNS/DHCP servers my LAN would stop working. Hence the need for back-up DNS. Many of my home server applications now are set up to operate via https via Traefik and this also relies upon correct local DNS resolution. Hence DNS is even more critical. The DHCP server is less critical, however all the IT equipment that relies upon DHCP will not function without this service. Most my critical services have static IP address.
These notes still have some utility. I will presumably archive (tl;dr; roll-up) eventually.
Actually my router that I was running these services was totally lost when upgrading from Debian 11 to Debian 12, circa June 2023. So I had to rebuild from scratch using these various notes. This went reasonably well as the notes seemed suitable for purpose.
This setup was primarily written in 2017 and is based upon ISC Bind9 and ISC DHCP, which are the main internet backbone software used for DNS and DHCP. I no longer use ISC DHCP as this has been formally replaced by ISC Kea.
(2022) ISC has a newer DHCP software called Kea that is designed to replace ISC DHCP. Kea was primarily developed around 2014-2020. They also are currently developing a monitor for Kea and Bind9 called Stork. A future plan would be to review and replace ISC DHCP with Kea and also implement Stork.
Main references used (2017)
DNS Setup
First install or ensure already installed the DNS server software: “sudo apt install bind9”
Next check the named.conf configuration file, “less /etc/bind/named.conf”. This can remain as default as below. However the configuration files noted there in will need to be set up. We will copy the existing files to default:
sudo cp /etc/bind/named.conf.options /etc/bind/default.named.conf.options
sudo cp /etc/bind/named.conf.local /etc/bind/default.named.conf.local
sudo cp /etc/bind/named.conf.default-zones /etc/bind/default.named.conf.default-zones
Bind9 Control Nomenclature
There are a number of “names” that are used with bind9 dns.
“bind9” is the
DNS software is known as isc_bind9, and systemctl in some Linux refers to the service as bind9.service.
“named” is the normal name of the isc-bind9 code that is call to start the application
“rndc” is an application used to control a running bind9 instance, e.g. rndc reload to reload the configuration
Setting Bind9 to IPv4 Mode
sudo vim /etc/default/bind9 or sudo vim /etc/default/named, set following parameter: OPTIONS=“-u bind -4”
named.conf
The /etc/bind/named.conf is not changed, and should look as below.
named.conf
// Default contents of /etc/bind/named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
Next modify the named.conf.options configuration file, sudo vim /etc/bind/named.conf.options, as noted below.
name.conf.options
options {
directory "/var/cache/bind";
auth-nxdomain no; # conform to RFC1035
forwarders {
9.9.9.9;
1.1.1.1;
1.0.0.1;
//208.67.222.222;
//208.67.220.220;
};
allow-query {
192.168.1/24;
127.0.0.1;
};
allow-transfer {
192.168.1/24;
127.0.0.1;
};
// listen-on-v6 { any; };
};
The forwarders section contains the DNS servers to be checked if this DNS does not have the record. I have been using OpenDNS to allow some free security screening, IP 208.67.222.222 and 208.67.220.220. I have stop using these. IP 9.9.9.9, Quadnine provides some protection bad web sites. Similar for 1.1.1.1 and 1.0.0.1. from Another common option is to use Google DNS at 8.8.8.8 and 8.8.4.4. I avoid using Google products as there is something unclean about free services that extra value by tracking you.
rndc-key
Next create a cryptographic key file using sudo /usr/sbin/rndc-confgen -a, note that this command can take quite some time to complete, a number of minutes. The command produces a key file /etc/bind/rndc.key.
rndc.key
key "rndc-key" {
algorithm hmac-md5;
secret "LBLC2Dg8v6hYNE/ecnd6Ag==";
};
Configure the DNS zones sudo vim /etc/bind/named.conf.local
named.conf.local
key "rndc-key" {
algorithm hmac-md5;
secret "LBLC2Dg8v6hYNE/ecnd6Ag==";
};
zone "kptree.net" {
type master;
file "/var/lib/bind/db.kptree.net";
allow-update { key rndc-key; };
};
zone "168.192.in-addr.arpa" {
type master;
file "/var/lib/bind/db.168.192";
allow-update { key rndc-key; };
};
lookup zone definition file
Modify the forward lookup zone definition file sudo vim /var/lib/bind/db.kptree.net
db.kptree.net
; This line indicates that the object we're configuring below (in this case,
; kptree.net) has its origin at the "." domain. "." is the root domain
; from which all the TLDs branch.
; Note the comment character is ; not the usual #
$ORIGIN .
; Next line defines the DNS time-to-live setting
$TTL 907200 ; 1 week 3 days 12 hours
; The next set of lines are the "Start of Authority" record and define
; important info about the domain. In my case, we're defining kptree.net
; that router.kptree.net is its source host, and webmaster@kptree.net
; and saying is the domain maintainer. For the e-mail address, we use a
; dot instead of an @.
; The lines after that define the zone serial number, which is used to
; keep track of when the zone file was modified, and then some interval
; which you can leave as default.
kptree.net IN SOA router.kptree.net. root.kptree.net. (
2019072101 ; serial
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
38400 ; minimum (10 hours 40 minutes)
)
; Next, we define the hosts necessary to make the domain function. First,
; we add an "NS Record" to define the domain's name server...
NS router.kptree.net.
; ...then an "A Record" for the domain server's IP address...
A 192.168.1.12 ; This is the LAN address of the html server
; that is hairpin NATed
; ...and finally "MX Records" so that e-mail for the domain's e-mail
; addresses goes to the right place.
MX 00 mail.kptree.net.
;
; NOTE THE TRAILING PERIODS. THEY ARE EXTREMELY IMPORTANT.
;
;
; Now we're ready to begin adding hosts, but first we need another origin
; statement to indicate that the hosts added below originate not from ".",
; like the domain itself; rather, they originate from "kptree.net".
;
$ORIGIN kptree.net.
;
; Again, NOTE THE TRAILING PERIOD.
; Now we add A records for the non-DHCP hosts in the domain:
router A 192.168.1.1
;switch A 192.168.1.3 ; This manage switch was bricked a while ago.
kptreeserver A 192.168.1.5
mediaserver A 192.168.1.7
wiki A 192.168.1.9
kpts A 192.168.1.10
cloud A 192.168.1.11
www A 192.168.1.12 ; www is directed to the html server
wwwserver A 192.168.1.12
;photo A 192.168.1.16 ; photo is directed to the html server
;photoserver A 192.168.1.17
mail A 192.168.1.12 ; mail is directed to the html server
mailserver A 192.168.1.18
; There seems to be no white space allowed before the name.
Note: To allow all LAN traffic to correctly flow to the html server and reverse proxy to sub-domain servers the DNS origin and all sub-domains must point to the main html server.
define reverse zone
Define the reverse zone, sudo vim /var/lib/bind/db.168.192
db.168.192
# Again, we have an origin record and a TTL entry...
$ORIGIN .
$TTL 907200 ; 1 week 3 days 12 hours
; note the name of the reverse domain: "db.168.192". This
; is a special name format used only by reverse lookup domains.
168.192.in-addr.arpa IN SOA router.kptree.net. admin.kptree.net. (
2017072101 ; serial
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
38400 ; minimum (10 hours 40 minutes)
)
NS router.kptree.net.
;
; Just like above, we now set our origin away from "." to the actual domain
; name, which is "1.168.192.in-addr-arpa", and then we add records. However,
; this time, we're adding "PTR records", or pointer records.
$ORIGIN 1.168.192.in-addr.arpa.
$TTL 259200 ; 3 days
1 PTR router.kptree.net.
; 3 PTR switch.kptree.net. ; This managed switch is bricked.
5 PTR kptreeserver.kptree.net.
10 PTR kpts.kptree.net.
12 PTR wwwserver.kptree.net.
12 PTR www.kptree.net.
12 PTR kptree.net.
; 17 PTR photoserver.kptree.net. ; not used at the moment
; 12 PTR photo.kptree.net.
18 PTR mailserver.kptree.net.
12 PTR mail.kptree.net.
If and of the above files are changed the serial number should be incremented up before updating the the DNS service, “sudo systemctl restart bind9”. A common technique is to use the date followed by a small single or double digit number, e.g. 2017072101.
The configuration file can be tested with:
The zone files checked with:
If not using IPv6 bind may still look for IPv6 unnecessarily filling up log files. To prevent perform the following:
sudo vim /etc/default/bind9
add the -4 in the line: OPTIONS=“-u bind -4”
Also ensure to comment out “listen-on-v6 { any; };” in the file sudo vim /etc/bind/named.conf.options
Fixing BIND's journal out of sync with zone error
Almost all ways caused by manually editing the zone file, which causes it to become out of sync with the automatic DHCP update. Solution is to:
Stop bind9 (sudo systemctl stop bind9)
Delete the problem zone file ending ing .jnl. It can be found in the same directory as the zone files: (/var/lib/bind/)
Then start bind9 (sudo systemctl start bind9)
Before performing a manual update on a zone file use rndc freeze before editing and rndc thaw after. See man rndc for information on his command.
Split Horizon DNS
Split horizon DNS or split DNS allows the DNS query to be treated differently depending upon the source of the query. It is is usually used for internal services that can not be reached off LAN.
I am not sure how split DNS addresses the use of SSL certificated domain names based upon external web address on local address hosts with outsome form of hairpin NAT or similar occurring. Think about it, the IP address on the local server does not match the domain certificate IP address.
hairpin_nat is used to allow services provided by hosts on the internal network to be reached externally via NAT also to be reached by internal clients behind a NAT. Split DNS is not a direct replacement of this functionality.
Some external resources:
Other Bind9 Stuff
Update Root hints Data File for Bind Named Server
Download latest bind9 root file to /etc/bind/db.root: sudo wget –user=ftp –password=ftp ftp://ftp.rs.internic.net/domain/db.cache -O /etc/bind/db.root
Reload rndc: sudo rndc reload
DHCP Setup
This section is outdated, ISC DHCP was replaced by ISC Kea, and ISC DHCP is no longer formally supported as of 2022.
Outdated tl;dr;
First install or ensure already installed the ISC DHCP server software: sudo apt install isc-dhcp-server
Next edit the dhcp configuration file: sudo vim /etc/dhcp/dhcpd.conf
dhcp.conf
ddns-updates on;
ddns-update-style interim;
update-static-leases on;
authoritative;
key rndc-key { algorithm hmac-md5; secret LBLC2Dg8v6hYNE/ecnd6Ag==;}
allow unknown-clients;
use-host-decl-names on;
default-lease-time 1814400; #21 days
max-lease-time 1814400; #21 days
log-facility local7;
# kptree DNS zones
zone kptree.net. {
primary localhost; # This server is the primary DNS server for the zone
key rndc-key; # Use the key we defined earlier for dynamic updates
}
zone 1.168.192.in-addr.arpa. {
primary localhost; # This server is the primary DNS server for the zone
key rndc-key; # Use the key we defined earlier for dynamic updates
}
# kptree LAN scope
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.100 192.168.1.200;
option subnet-mask 255.255.255.0;
option routers 192.168.1.1;
option domain-name-servers 192.168.1.1;
option domain-name "kptree.net";
ddns-domainname "kptree.net.";
ddns-rev-domainname "in-addr.arpa.";
}
# kptree.net groups
group {
# Printer #1 Epson WF7725
host printer1.kptree.net {
hardware ethernet 9C:AE:D3:F0:C3:E7;
fixed-address 192.168.1.4;
ddns-hostname "printer1";
}
# Windows 10 Virtual Machine
host vwin.kptree.net {
hardware Ethernet 52:54:00:27:34:F4;
fixed-address 192.168.1.30;
ddns-hostname "vwin";
}
# Karl's iPhoneXS
host karlPhone.kptree.net {
hardware ethernet F0:99:B6:45:6C:F4;
fixed-address 192.168.1.31;
ddns-hostname "karl-phone";
}
# Karl's iPadMini4
host karliPad.kptree.net {
hardware ethernet 04:52:F3:1C:31:27;
fixed-address 192.168.1.32;
ddns-hostname "karl-ipad";
}
# Eka's iPhone12
host Eka-iPhone12.kptree.net {
hardware ethernet 44:90:BB:62:D2:2A;
fixed-address 192.168.1.33;
ddns-hostname "Eka-iPhone12";
}
# Karl's iPad air
host karliPadair.kptree.net {
hardware ethernet 34:31:8F:5F:16:A6;
fixed-address 192.168.1.34;
ddns-hostname "karl-ipadair";
}
# Karl's work
host karl-ugl.kptree.net {
hardware ethernet 5C:80:B6:A8:AE:1C;
fixed-address 192.168.1.35;
ddns-hostname "karl-ugl";
}
# Henry's iphone
host henry.iphone.kptree.net {
hardware ethernet 6c:4d:73:12:99:f1;
fixed-address 192.168.1.36;
ddns-hostname "henry-iphone";
}
# Willem's iphone
host willem.iphone.kptree.net {
hardware ethernet 64:c7:53:7b:01:2f;
fixed-address 192.168.1.37;
ddns-hostname "willem-iphone";
}
# KPTreeServer1 IPMI
host kpts1-ipmi.kptree.net {
hardware Ethernet 00:25:90:8B:D9:DB;
fixed-address 192.168.1.40;
ddns-hostname "kpts1-impi";
}
# Kptreeserver2 IPMI
host kpts2-ipmi.kptree.net {
hardware Ethernet 0C:C4:7A:F5:0E:F7;
fixed-address 192.168.1.41;
ddns-hostname "kpts2-impi";
}
# KPTreeRouter IPMI
host kptr-ipmi.kptree.net {
hardware Ethernet 00:C4:7A:9F:34:41;
fixed-address 192.168.1.42;
ddns-hostname "kptr-ipmi";
}
# APS Solar Energy Management Unit
host aps-ema.kptree.net {
hardware Ethernet 80:97:1B:00:36:BA;
fixed-address 192.168.1.50;
ddns-hostname "aps-ema";
}
# OpenSprinkler
host sprinkler.kptree.net {
hardware Ethernet 00:69:69:2D:31:00;
fixed-address 192.168.1.51;
ddns-hostname "sprinkler";
}
# Study Desktop - dt1
host dt1.kptree.net {
hardware ethernet 00:d8:61:34:dc:0e;
fixed-address 192.168.1.71;
ddns-hostname "dt1";
}
# Study Desktop - dt1-wifi
host dt-wifi-1.kptree.net {
hardware ethernet F4:D1:08:A6:96:72;
fixed-address 192.168.1.72;
ddns-hostname "dt-wifi-1";
}
# Erich Desktop - sdt25
host edt25.kptree.net {
hardware ethernet 00:8e:25:79:05:cc;
fixed-address 192.168.1.73;
ddns-hostname "sdt25";
}
# Henry's work
host henry-desk.kptree.net {
hardware ethernet 30:5A:3A:82:9D:35;
fixed-address 192.168.1.74;
ddns-hostname "henry-desk";
}
# Study Desktop - sdt1-wifi
host sdt-wifi-1.kptree.net {
hardware ethernet 8C:1D:96:94:AD:13;
fixed-address 192.168.1.76;
ddns-hostname "sdt-wifi-1";
}
# Study Desktop - sdt25
host sdt25.kptree.net {
hardware ethernet 1C:69:7A:D2:FD:91;
fixed-address 192.168.1.77;
ddns-hostname "sdt25";
}
# RPi 1
host RPi1.kptree.net {
hardware ethernet E4:5F:01:3B:55:6F;
fixed-address 192.168.1.75;
ddns-hostname "RPi1";
}
# WiFi Access Point #1
host wifi-ap1.kptree.net {
hardware Ethernet 80:37:73:EC:D3:1E;
fixed-address 192.168.1.90;
ddns-hostname "wifi-ap1";
}
# WiFi Access Point #2
host wifi-ap2.kptree.net {
hardware Ethernet C0:FF:D4:8B:24:FE;
fixed-address 192.168.1.91;
ddns-hostname "wifi-ap2";
}
}
The configuration file can be tested with: sudo dhcpd -t
Restart the DHCP and DNS servers to update for latest configurations changes. DNS: sudo systemctl restart bind9 and DHCP: sudo systemctl restart isc-dhcp-server.
To see active leases use command sudo dhcp-lease-list.
ISC has stopped supporting ISC-DHCP client and relay versions as of 2022 and indicated that they plan to eventually stop support of server version. They seem to recommend migration to ISC-Kea, the ISC-DHCP replacement.
isc-dhcp-server defaults file
The default isc-dhcp-server configuration files is: sudo vim /etc/default/isc-dhcp-server. Ensure the interface(s) that the DHCP server is to server requests upon is indicated, for example:
INTERFACESv4=“br0”
INTERFACESv6=“br0”
Unfortunately the log / journal for isc-dhcp-server contains the following comment for each system interface that is not assigned in /etc/default/isc-dhcp-server. This is a warning, not an error! As such it can generally be ignored.
Example isc-dhcp-server warning
No subnet declaration for eno4 (no IPv4 addresses).
** Ignoring requests on eth1. If this is not what
you want, please write a subnet declaration
in your dhcpd.conf file for the network segment
to which interface eno4 is attached. **
ipv6
radvd
ipv6 requires router advertisement to be functional to operate correctly. In Linux the radvd program performs this function and can be set up independently or with dhcp. The radvd daemon provides basic advertisement functionality, dhcp6 can give additional functionality.
DNS Check Commands
local dns nameserver
The local name resolver can be seen in /etc/resolv.conf. Usually this can not be effectively directly edited as it is controlled by other parts of the system that will wrote over it.
dig
dig bing.com, this will provide the name resolution information for this site.
dig @1.1.1.1 wiki.kptree.net will check name resolution @ the specified resolver. This can help determine name propagation.
dig mail.kptree.net will return mail server information
dig @9.9.9.9 mail.kptree.net will return mail server information @ the specified resolver
host
host mail.kptree.net
host kptree.net
nslookup
secure DNS
ipv6 links