search

opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.31k stars 738 forks source link

KEA: Request to Enable “reservations-out-of-pool” and “match-client-id” Options via GUI in OPNSense #7293

Closed DonPablo1010 closed 7 months ago

DonPablo1010 commented 7 months ago

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Is your feature request related to a problem? Please describe.

I am encountering a specific issue with the KEA DHCP Server configuration in OPNSense. When a manual static IP address is configured for a host within the network, and a corresponding reservation (matching IP and MAC address) is set in the KEA DHCP server (outside of dynamic pool), the affected host appears to lose network connectivity immediately upon activating the reservation within KEA.

While I suspect that the configuration adjustment in title resolves the connectivity issue, allowing the network hosts to potentially maintain their connectivity seamlessly, I have not been able to conduct thorough testing to confirm this due to limitations in changing the .conf files.

Describe the solution you like

Given the critical nature of these options in potentially resolving the connectivity issue, I kindly request that the OPNSense GUI be updated to allow users to configure the “reservations-out-of-pool” and “match-client-id” options directly. This will ensure that changes made to the KEA DHCP server configuration persist and accurately reflect the desired network behavior without causing connectivity disruptions for network hosts.

Describe alternatives you considered

I am also open to exploring alternative solutions that address the described problem effectively. Any suggestions or recommendations are highly appreciated.

Additional context Firewall: OPNsense 24.1.2_1-amd64 FreeBSD 13.2-RELEASE-p10 OpenSSL 3.0.13 Intel(R) Atom(TM) Processor E3930 @ 1.30GHz (2 cores, 2 threads)

Host with Problems: DietPi v9.1.1 Rock Pi 4C+

AdSchellevis commented 7 months ago

Given the many configuration options available with, an example of the proposed configuration file would help progress this.

As far as I could find, match-client-id is true by default, not sure about reservations-out-of-pool, finding defaults in the reference manual is aparantly quite painful.

DonPablo1010 commented 7 months ago

I just noticed that the issue wasn’t with the KEA DHCP server or OPNSense. Instead, a kernel upgrade (Armbian) executed shortly after the migration to KEA on the affected mini-server caused the system to crash. The fact that after multiple reboots and simultaneously removing and adding the reservation temporarily seemed to point to KEA was probably more due to coincidence. I switched back to ISC DHCP4, and lo and behold, the connectivity was suddenly gone here too. I then realized that my NTF shares triggered a kernel panic whenever they were supposed to be used. I have now deployed the system in the same configuration in a virtual machine, and I can definitively confirm that the described problem with KEA no longer occurs. I set a static IP for the VM in the configuration and simultaneously inserted a congruent reservation in KEA; everything runs smoothly now…

I’m sorry to have bothered you. Thank you very much for your help and support in resolving this issue.

th3voic3 commented 2 months ago

If we could turn off match-client-id globally and/or per subnet that would be great.

On main PC I use dracut with networkd to enter my luks password from my phone. For some reason dracut sends a different client-id than networkd once the system is fully booted. The Mac address stays the same. With ISC this isn't an issue but it causes KEA to ignore the reservation and assigning a different address to the fully booted system.

This is the only reason I switched back to ISC for now.