Fast DHCP - Page 1
Forum section: electronics / general

author: PlainName
author_rank: Super Contributor
timestamp: February 02, 2025, 05:27:47 pm
content: Sometimes the network has to be shut down, typically when we get a powercut and it's likely to be down for more than half an hour. Not a big issue - everything would survive a sudden power outage, but the servers are on a UPS to allow time for manual shutdown.However, bringing it back up is a problem because the DHCP server is in a VM. That box, like many backend machines, takes forever plus 10 mins to just power up past POST, and then the VM manager has to get going, and then the VM has to start, etc. Meantime, everything else has booted and asked for an IP then given up and picked some random thing. A large proportion of the power-up sequence is going around to reboot everything once DHCP is running.What I am looking for are suggestions for a simple means to have a DHCP server come up fast. Requirements are reasonably simple but not simple enough for many possible solutions: a block of static addresses and a (different!) block for DHCP assignments. The ability to have more than one DHCP block depending on stuff like MAC organisation, OS type, etc would be nice but not currently necessary. However, the DHCP server does need the ability to assign static addresses to specific MACs (and there are quite a few - a way to block enter those would be cool).Finally, the ability to save and restore the config, preferably in a human readable (and potentially writable) form, is pretty much needed.Any ideas?

author: eleguy
author_rank: Regular Contributor
timestamp: February 02, 2025, 05:46:41 pm
content: Maybe it is good idea at least to checkhttps://opnsense.org/

author: PlainName
author_rank: Super Contributor
timestamp: February 02, 2025, 06:02:26 pm
content: Thanks. I actually run pfSense which is very similar, and the DHCP server isn't really applicable - it is like the feature on a lot of routers in that it is there as an additional feature and not a core product. One particular thing that I forgot to mention, and the xxsense has trouble with, is making a reservation within the dynamic range. Sometimes very useful (to make sure some temporary thing stays where you think it is). As is being able to set an arbitrary range, not just one that fits, say, a subnet class.The one I use currently isHanewin, which works very well. Just not before anything else

author: madires
author_rank: Super Contributor
timestamp: February 02, 2025, 06:25:31 pm
content: Anything linux with Kea DHCP (https://www.isc.org/kea/) plus Stork (web UI for Kea,https://www.isc.org/stork/).

author: PlainName
author_rank: Super Contributor
timestamp: February 02, 2025, 09:38:37 pm
content: Interesting, thanks. That's certainly not limited in any wayI think it kind of defeats the purpose, though. It would need a new VM with linux just to run that, and of course that VM is going to be slow to boot.... An alternative, and possibly more what I had in mind, is to try running it on a RPi. A quick google suggests that might be difficult, particularly for someone essentially new to the Pi (and Linux).

author: wraper
author_rank: Unknown
timestamp: February 02, 2025, 09:45:45 pm
content: QuoteIf you're going to buy hardware, you could use almost any cheap router for that, will be cheaper than RPi and needs no tinkering.

author: PlainName
author_rank: Super Contributor
timestamp: February 02, 2025, 10:08:06 pm
content: Cheap routers don't have the feature set, which is one reason I'm not already using the decent router already on the network.

author: indeterminate
author_rank: Regular Contributor
timestamp: February 02, 2025, 10:17:11 pm
content: Run OpenWrt on the routerhttps://openwrt.org/docs/guide-user/base-system/dhcpyou can get prebuilt images for a huge range of cheep routers.

author: PlainName
author_rank: Super Contributor
timestamp: February 02, 2025, 10:31:51 pm
content: OpenWRT doesn't seem to be particularly user friendly: to see leases, awk is apparently a useful tool. I really don't want to be messing about with CLIs. A typical thing I might do currently is shove something on the network then pop into the GUI display of dynamic leases to see where it is. Click it, say make this so-and-so static (and delete this address), ok, done. Does OpenWRT allow similar simple operation?

author: ejeffrey
author_rank: Super Contributor
timestamp: February 02, 2025, 10:40:55 pm
content: The easiest thing would be to run the DHCP server on a different machine that boots faster or has a much longer lasting UPS. A raspberry pi or something can run as complicated of a DHCP configuration as you want and is low enough power you can have very long backup times.Assuming that's just not practical, are you using a managed / smart network switch? If you power cycle or reboot the network switch all of the directly attached devices should see the link cycle and retry DHCP. You could have a bootup script on your DHCP server that reboots the switch after the DHCP server is running.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 02, 2025, 10:47:45 pm
content: Delegate your DHCP to a small, fast booting mini-PC running Linux and a full featured DHCP server - I'd favour Fedora Server but whatever fits in your environment.I use a PC Engines APU3D4 but any SFF or mini PC should do.

author: PlainName
author_rank: Super Contributor
timestamp: February 02, 2025, 11:15:57 pm
content: QuoteYes, that's a solution (if the Pi could run an acceptable server). I could imagine powering just that from a small UPS (or current equivalent), although being able to come up quickly would be nice.QuoteYep, but unfortunately a lot of stuff is on WiFi. I do have to reboot the access points (even though they are static IP - they're this mesh thing which thinks for itself when there is lack of authority), but even doing that doesn't clear up some devices.

author: PlainName
author_rank: Super Contributor
timestamp: February 02, 2025, 11:24:53 pm
content: QuoteGot some PC Engines kit and even pukka mini-PCs, but Linux doesn't seem to be particularly fast booting. Still, that's beginning to look like the only reasonable alternative.Part of my problem is that it's not a problem for a long time. We don't often get powercuts so between times it doesn't seem to be that important. When it does happen, though, I remember the previous tediousness and figure I really should do something about it...

author: ejeffrey
author_rank: Super Contributor
timestamp: February 02, 2025, 11:51:17 pm
content: Quote from: PlainName on February 02, 2025, 11:15:57 pmThe Pi can definitely run an acceptable DHCP server, and it should boot up in about 30 seconds. It will also be able to run for hours on a UPS or a DC battery bank. You shouldn't tolerate a computer that takes 10 minutes to boot in 2025.QuoteMaybe leave the wifi access points off for a bit longer or make sure that they are all off at the same time? If the device thinks it's just a bit of radio fade or that it's roaming between access points it may not renew the lease. But if the wifi is off for ~30 seconds, it should trigger re-association for most devices. If you had a way that the access points would not enable their radios until the DHCP server was active that would be even better.

author: ejeffrey
author_rank: Super Contributor
timestamp: February 02, 2025, 11:53:07 pm
content: Quote from: PlainName on February 02, 2025, 11:24:53 pmI would think seriously about this. If it takes you 10 minutes of rebooting a few times a year, it may not be worth solving, even if it is annoying.

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 12:19:40 am
content: QuoteNot possible. OK, strictly it is, but having to go round turning them off before power comes back, then turning them on once the server it is up, it actually more hassle than just waiting for the server than then recycling the AP power. ISTR they are best booted in a specific order too, the primary needing to be up before the others get going.

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 12:22:42 am
content: Quote from: ejeffrey on February 02, 2025, 11:53:07 pmYes, I've been a long time coming hereBut this thread has been useful even if a solution doesn't pop up. I mean to look seriously at kea DHCP and see if I should switch to that.

author: ejeffrey
author_rank: Super Contributor
timestamp: February 03, 2025, 12:29:30 am
content: Quote from: PlainName on February 03, 2025, 12:19:40 amYeah, all my APs are wired and on POE. So if I reboot the main switch it pretty much works for all wired and wireless clients.

author: BradC
author_rank: Super Contributor
timestamp: February 03, 2025, 12:46:06 am
content: I have a Pi set up for secondary DNS and DHCP for precisely this reason. Doesn't matter what is happening with the main server, everything can still get an address and resolve.As with everything, this was prompted by an "event". I have a managed PDU and IP KVM. The server had a hardware issue and got stuck in a boot loop. I couldn't get access to the PDU or KVM because I had no record of their static IPs and had to manually configure the network on my laptop because DHCP was down.I ended up using nmap to scan the management network to find the devices and get into them that way, but next step was to set up a secondary for DHCP & DNS.It wasn't hard to configure, but I have a few years under my belt with the old ISC DHCP server, BIND and the RPi.

author: brucehoult
author_rank: Super Contributor
timestamp: February 03, 2025, 12:47:46 am
content: Quote from: PlainName on February 02, 2025, 11:15:57 pmHow could a machine with four 2.4 GHz cores and up to 16 GB RAM possibly NOT run any complexity of software you need?You can probably find/make something in the Arm / RISC-V / N100 space with a cut-down kernel that boots in 10 seconds if not 5.I'd bet a $5 Milk-V Duo would do the job just fine. That's a single core 1 GHz CPU with 64 MB RAM. Mine boots to the point of being able to SSH into it in 25 seconds, though it's already responding to pings by 15 seconds.And, drawing 0.5W of power (100mA), you can run it off an airline-legal 100Wh USB power bank for more than a week, which would make boot time actually irrelevant anyway. Even a massively powerful Raspberry Pi 5 uses only 2.5W at idle, so it'd run of fthe same pocketable power bank for nearly two days.

author: Monkeh
author_rank: Super Contributor
timestamp: February 03, 2025, 01:15:36 am
content: Quote from: PlainName on February 02, 2025, 09:38:37 pmSo don't use a slow VM host to run it, use a dedicated machine which doesn't take 30 seconds to run through the firmware. A Pi 5 with a real SSD instead of a silly SD card should be able to be up and running in under 20 seconds. There's nothing inherently slow about booting Linux, and indeed once hardware issues are eliminated, it can be done in just a second or two.Quote from: PlainName on February 02, 2025, 06:02:26 pmOPNsense is quite well fleshed out for DHCP capability, including setting any dynamic range you want and static leases within that range - however, because of how the server operates, a static lease within the pool can be handed out to a dynamic client if it's not taken by the static one. I don't know if that behaviour is different with Kea.I switched to OPNsense from pfSense because of these sorts of limitations. It's far more flexible.

author: mwb1100
author_rank: Frequent Contributor
timestamp: February 03, 2025, 01:29:41 am
content: The dnsmasq program can act as a DHCP server (also a DNS or TFTP server, but those can be disabled if all you want is DHCP). AFAIK there is not Windows port, so you'd probably have to this on a Linux machine. I imagine an RPi or similar running Linux would have no problem.dnsmasq should support the following from your list of requirements:- static addresses based on MAC address: there can be a simple text file specifying the MAC-->static IP configuration- DHCP blocks specified by MAC organization: using the --dhcp-mac=set:<tag>,<MAC address> configuration a "tag" can be assigned based on the MAC organization (since wildcards are permitted in the <MAC address> part of the option). The tag can be used to match a specified address pool.I don't know whether or not it can support using the OS Type to map to specific address pools.I also don't know what is meant by the requirement "a block of static addresses "However, I'm unaware of a GUI to configure dnsmasq. The configuration is done by command line option and/or configuration file(s).Going though the config options initially might be daunting (there are a lot of them), but I think once initially done that it would be straightforward to do any reconfiguration you want.In comparison though, my brief look at the Kea DHCP server documentation left my head spinning.

author: brucehoult
author_rank: Super Contributor
timestamp: February 03, 2025, 01:38:28 am
content: Here is a GUI for managing DHCP (and many other services) on Linux / Unix hosts:https://webmin.com/docs/modules/dhcp-server/

author: Monkeh
author_rank: Super Contributor
timestamp: February 03, 2025, 02:05:57 am
content: Quote from: brucehoult on February 03, 2025, 01:38:28 amwebmin's still going? Jeez. Haven't looked at that in a decade or more.

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 08:56:20 am
content: Quote from: Monkeh on February 03, 2025, 01:15:36 amYes, exactly. If the client would just stay up and connected I wouldn't need the feature!/quote]I switched to OPNsense from pfSense because of these sorts of limitations. It's far more flexible.Same limitation on this, AFAICS.

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 08:58:13 am
content: Quote from: brucehoult on February 03, 2025, 01:38:28 amThanks. I am running a machine with webmin management. Although it's not one that would lend itself to this task it'll be OK for simple investigation of this.

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 09:01:21 am
content: QuoteMaybe if appropriate software doesn't exist on it? Maybe asking someone if it does and all that might be useful.

author: brucehoult
author_rank: Super Contributor
timestamp: February 03, 2025, 09:07:21 am
content: Quote from: PlainName on February 03, 2025, 09:01:21 amMost of the world's internet infrastructure runs on Linux. The software exists.

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 09:08:07 am
content: Quote from: BradC on February 03, 2025, 12:46:06 amSounds like exactly the issue I started with (since mitigating somewhat by having IP address set up for management via the front end as well). A second Pi might invited to join the network soon.

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 09:27:05 am
content: QuoteSure, but mine doesn't. We're a (obsolete) Windows house here so stuff that will run on whatever box is going would be nice. Particularly since I have a decent idea of how they work and how to fix them. Linux is an alien black box I don't have a clue about, and when the network is down you can't google obscure command lines you didn't know you needed to sort things out.As I note, it's a reasonably successful setup in that it works and does what we want in a way we find useful. The apps for doing that are good and chosen because they were more appropriate than 'classic' alternatives. Just annoying to have this walk around on a cold start.There are other considerations which lurk in the background too. For instance, once something like DHCP is separated off from the main server there's the issue of backup and replication on failure to consider. That's already handled in the current setup, but would need sorting out afresh. If the Pi blows up how do I fix it? Would that mean a spare, and what exactly needs backing up to get it going again?

author: BradC
author_rank: Super Contributor
timestamp: February 03, 2025, 09:32:41 am
content: Quote from: PlainName on February 03, 2025, 09:27:05 amThat might have been handy to know in the first post.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 03, 2025, 09:43:48 am
content: If you are a Windows only house then fair enough.But small PCs can run Windows as well - not a PC Engines board as Windows (AFAIK) insists on graphics, but there are plenty of options and Windows can boot reasonably quickly if you tweak it.Or look at an appliance such as the DNSBOX from Appliansys (declaration of interest - I nearly went to work for them when they were small enough that the CEO was interviewing me, they seemed like nice guys at the time and appear to have done well, I never did work for them though).

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 10:14:52 am
content: Quote from: BradC on February 03, 2025, 09:32:41 amSorry, didn't think. It's not critical - I already have a Pi that acts as probe into the broadband connection for Wireshark, so I'm not completely averse to that kind of thing. Just that isn't where whatever expertise I have lies

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 10:20:04 am
content: QuoteYes. It's not the OS per se but the box. Originally it was all discrete boxes, but quite quickly you figure shoving them all into VMs makes sense - easily transferable in case of hardware issues to a new box, or just spread the load over a couple, have hot standby, etc. Not to mention cheaper to run as well, and easier to provide UPS and stuff.So there is a bit of a downer on having discrete boxes. But DHCP is just surely just a one-off and won't lead to ever increasing boxen taking over the place...

author: bitwelder
author_rank: Super Contributor
timestamp: February 03, 2025, 10:35:37 am
content: How about adding some extra (cheap) UPS power only to the server that has the VM with the DHCP service (and other essential network services)?Perhaps also moving them to a smaller server that uses the same hypervisor (for easy migration), but it's less power-hungry?

author: brucehoult
author_rank: Super Contributor
timestamp: February 03, 2025, 10:38:00 am
content: Quote from: PlainName on February 03, 2025, 09:27:05 amYou can run it in docker or k8s or whatever on the Pi if you want.

author: brucehoult
author_rank: Super Contributor
timestamp: February 03, 2025, 10:44:18 am
content: Quote from: bitwelder on February 03, 2025, 10:35:37 amA UPS for the big honking Windows server that takes ten minutes to start up probably isn't going to work but, yes, the same software stack will no doubt run on an N100 or whatever.I have a i7-8650U NUC (quad core 4.2 GHz max turbo, 32 GB RAM, 512 GB SSD) that was my main computer in 2018-2019 when I was travelling a lot -- it literally fit into my jeans front pocket, and it used about 6W at idle (which is the state 99% of the time for most incidental servers such as DHCP).

author: Halcyon
author_rank: Unknown
timestamp: February 03, 2025, 11:30:05 am
content: Your choice of pfSense is a solid one, but this is one of the limitations you run into when you virtualise it, it's not a pfSense issue per-se.I had similar issues, particularly if the server goes down and there is no internet to diagnose the issues (it happened to me back when I was running ESXi, I've since dumped that garbage and switched to Proxmox). I stopped virtualising my router a long time ago as the negatives outweigh the positives, so just use a Netgate appliance these days (although as others have suggested, a small, low-power PC is just as good). Config can easily and quickly be backed up and restored, even if you need to re-build a machine.Your ultimate solution is to find a way to bring your router up before everything else. For me, it's not a drama as the router initialises before the Ubiquiti switches and access points, so by the time the network is "ready", DHCP is there to take requests.Does your UPS have the option of outlet groups? Perhaps upon power restoration, allow your router to come up first and delay the switch-on of your switch(es) and access points? That way your clients will just see the link as down during that initial restoration phase, and re-establish the network connection gracefully, even if they are the first to boot up.Also, speaking of pfSense and DHCP, ensure you've switched over to Kea DHCP as it's production-ready and ISC DHCP will be removed in future versions. It's just a ticky box and everything should transition over smoothly.

author: nfmax
author_rank: Super Contributor
timestamp: February 03, 2025, 11:50:16 am
content: The FireBrick FB2900 router has a maximum boot time of 5 seconds, usually much less, does DHCP, and a configuration controlled by a single XML file

author: PlainName
author_rank: Super Contributor
timestamp: February 03, 2025, 01:09:38 pm
content: QuoteThanksQuoteIt's not virtualised and runs on dedicated hardware. But the DHCP server in it isn't suitable (for previous reasons), so that lives in a VM. The VM is currently on an IBM X3100 which takes a long time to post - that's the primary issue. I am in the process of migrating to a gen8 HP microserver but that takes twice as long. Almost as if there's a dwarf in there writing the boot code in realtime!The IBM and HP are nice once going, and are low power (important since they are on 24/7).QuoteTried that (albeit not this specifically, but small UPS for single machine). Didn't end well and also doesn't last - and extended outage is going to kill it some time. Brucehoult's suggestion of a USB charge brick for a Pi has merit (lasting a couple of days would be super), though I am circumspect about leaving one of those on perma-charge.QuoteJust acquired a spare on which I will run up Proxmox to check that out before putting it to real use. I like that ESXi will run off an SD card, which the microserver has fixed internally and will boot from. Easy to keep a spare SD card (or USB stick) to swap in or shove in something else if necessary.

author: Monkeh
author_rank: Super Contributor
timestamp: February 03, 2025, 03:06:46 pm
content: Quote from: PlainName on February 03, 2025, 08:56:20 amWith suitable lease times, it's not a major issue. Don't set them to five minutes. You could also just give it a static IP not in the pool and never worry about this misuse, or stop caring about IPs - DNS was invented, oh, 40 years ago..

author: brucehoult
author_rank: Super Contributor
timestamp: February 03, 2025, 10:16:43 pm
content: Quote from: Monkeh on February 03, 2025, 03:06:46 pmOn a stable company internal network where you don't have lots of randos coming and going I don't know why you'd set a lease time less than 30 days.Sure, on the visitor WIFI set a short one -- like a day.

author: Halcyon
author_rank: Unknown
timestamp: February 04, 2025, 02:43:28 am
content: Quote from: PlainName on February 03, 2025, 01:09:38 pmJust be careful. Depending on how much activity that server sees, it might be a quick way to kill SD Cards. For that reason, it's not recommended to run Proxmox off flash storage like SD cards or USB drives. But your milage, of course, may vary.Quote from: PlainName on February 03, 2025, 01:09:38 pmSorry I must have missed that for whatever reason. I went back to your original post, what you're trying to do doesn't seem that out of the ordinary? What is it you're doing that Kea DHCP can't?

author: PlainName
author_rank: Super Contributor
timestamp: February 04, 2025, 09:05:21 am
content: AFAIK the card is just used to boot from. ESXi loads into memory and runs from there (another cause of slow boots).

author: PlainName
author_rank: Super Contributor
timestamp: February 04, 2025, 09:09:38 am
content: QuoteNothing - Kea looks good. If it has a useful GUI which allows setting and following allocations it would be OK. Except... it's going to need something to run on, which is going to have a similar issue to the existing setup: VM.. OS... slow. But maybe putting it on a Pi, which could be made immune to power issues and, hence, boot times, would work. So currently pondering options.

author: BradC
author_rank: Super Contributor
timestamp: February 04, 2025, 09:28:57 am
content: Quote from: PlainName on February 04, 2025, 09:09:38 amIf you are reliant on a GUI I'd look at one of the hundreds of devices that can run OpenWRT. It's DHCP GUI is actually not bad.

author: PlainName
author_rank: Super Contributor
timestamp: February 04, 2025, 09:54:20 am
content: I'll get around to taking a look at some point, but I don't think it does anything better than my pfSense box. Although separating out routing and DHCP functions is attractive.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 04, 2025, 11:38:37 am
content: Quote from: BradC on February 04, 2025, 09:28:57 amAlthough I'd agree - and run OpenWRT extensively - installing it on a new device can be tricky.

author: Monkeh
author_rank: Super Contributor
timestamp: February 04, 2025, 03:31:08 pm
content: Quote from: PlainName on February 04, 2025, 09:09:38 amWhy does a VM have to be involved? I have perfectly ordinary every day x86 machines with boot times <30s, it doesn't take any particular effort to achieve that. A Pi 5 with an NVMe drive should be able to boot in under 20 seconds.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 04, 2025, 05:56:25 pm
content: I'd use aNanoPi R3S(Wiki) with 2GB RAM and 32GB eMMC and the case for this. It has two gigabit ethernet connectors (with >930 Mbits/s throughput each according to iperf), and in the Wiki you can find links to Debian, Ubuntu, OpenMediaVault, ProxMox VE, andFriendlyWRT(with or without Docker, basically a customized configuration of OpenWRT maintained in source form at GitHub); I'd use FriendlyWRT. The processor is a RockChip RK3566, quad-core ARM Cortex-A55 running at up to 1.8 GHz. It is well supported in Linux, and FriendlyElec supports open source.Or, perhapsNanoPi R5S-LTS(Wiki) with 4GB RAM and 32GB eMMC and the case, is another option. It has three gigabit ethernet connectors, and the same OS support (and I would install FriendlyWRT 23.05, or later). The processor is a RockChip RK3568B2, quad-core ARM Cortex-A55 running at up to 2.0 GHz. It might be a bit more expensive, but as LTS, should be available for longer.One of the ethernet is native (directly supported by the SoC), and the others are via PCIe. The eMMC on these particular models are NOT replaceable, they're soldered in, but they are much more robust than SD cards and faster than most. Not equivalent to NVMe SSDs, but not too slow either.The above are in the ~ 60€ all told price class, so you can easily get two, and use the other for testing updates and to play with, and of course as a emergency backup. You can find the distributorshere, or use AliExpress (but pick a reliable seller).If you want something more grunty for some reason, with native PCIe fast NVMe storage for getting boot times under 10 seconds, I can suggest something else for a Linux machine. However, for a managed DHCP server, the NanoPi R3S or R5S running FriendlyWRT straight off the box, sounds like the best solution for not-very-Linux-keen PlainName, I'd wager. And, at this price range, it is not too large an investment if the OpenWRT/FriendlyWRT interface turns out to not be suitable. (As for functionality, consideringOpenWRTis used in many routers and switches for just this kind of purpose, itwilldefinitely work.)

author: PlainName
author_rank: Super Contributor
timestamp: February 04, 2025, 06:17:21 pm
content: QuoteAs I said earlier, originally everything had its own box. That had/has several downsides which the VM approach resolves:* less power* cheaper hardware* less space* ease of hardware disaster recovery* low to zero cost warm standby* ease of management* lack of KVM requirementSo I don't want to start filling the place with discrete single-function boxen again, which then need their own management and backup processes, etc.

author: PlainName
author_rank: Super Contributor
timestamp: February 04, 2025, 06:21:04 pm
content: QuoteThanks. Don't think it needs to be particularly fast for this, and if it boots quicker than the WiFi (and copes with having the power dropped without warning) that could be The Thing.

author: Monkeh
author_rank: Super Contributor
timestamp: February 04, 2025, 06:52:32 pm
content: Quote from: PlainName on February 04, 2025, 06:17:21 pmAnd as you've found, your choices have placed you in a position which requires either constant backup power, power sequencing, or.. discrete hardware.Frankly, if your existing pfSense box boots fast enough already, the best solution is stop worrying about abusing DHCP reservations in-pool and just use it. If the DHCP configuration is really still that inflexible (it's pfSense, that's not a shock), consider migrating over to OPNsense.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 04, 2025, 07:06:42 pm
content: All MLC flash memories are susceptible to sudden power-off, because each page is twinned with another. That is, if the latter write to a twinned page is interrupted, also the first-written twinned page is garbled. Pseudo-SLC (pSLC) avoids this by writing both pages with the same content. eMMC does suffer from this, but mounting operating system read-only and using separate partition for configuration files with aggressive writeback makes it quite robust. I'm not exactly sure what options FriendlyWRT uses, but it does have some eMMC support extras.In comparison, the controller in SD cards can also get confused from unexpected power-off (especially midway during a write), and you can brick many easily by just yanking them out mid-write.I do not have either NanoPi, but according to reports, with the standard FriendlyWRT image they should boot in 30 seconds, from power on till services fully working. It's typical for OpenWRT-based devices, too. Itcanbe shaved down to much less, especially for something as simple as a DHCP server, but that does make maintenance harder. Also, the boards are low-power, so their bulk capacitance might be enough for the eMMC to ensure twinned pages are flushed even at a sudden power loss.As NanoPi R3S and R5S are powered at 5V via USB-C (2A max), you could use a 5V 2A desktop UPS for it. They're not expensive. That would guarantee that if the power outage lasted only a few hours, the DHCP would be up by the time any other device starts up.

author: DimitriP
author_rank: Super Contributor
timestamp: February 04, 2025, 07:33:18 pm
content: QuoteI don't know if we are talking about 50, 500 or 5000 machines in the same building or campus or spread in 3 countries and two continents ...so ..size and complexity nonwithstanding:I expect in this network (close to where "internet comes in" ) , there is probably a smart/managed switch that can handle DHCPSince it's already there, it's not a discrete single-function boxMy goal would be to have DHCP available as soon as an internet connection is available .

author: PlainName
author_rank: Super Contributor
timestamp: February 04, 2025, 10:24:18 pm
content: QuoteThere are things that would be more than happy to provide DHCP if I would only enable it. But they the feature phone version compared to the desired smart phone ability - typically, they are tickbox features there only because every similar box has it so marketing insist it's needed.Why does a broadband router have DHCP? Obviously, because the customer doesn't have the ability to sort out addressing for themselves (and DHCP isn't strictly necessary). So to head off the customer service calls and returns, "just shove a basic DHCP thing in there" and it's a job done. Why does the WiFI access point need a DHCP server in it? Same reason, no doubt. But the simplicity of implementation means there are two issue for me:1. Management is in the range 'crap' to 'terrible'.2. Every implementation does it their own way, so if you use some (relatively) nice feature you are locked into that product unless you want to relearn everything with a different implementation.So for core stuff like this I want it to be nice to do what I need (or just want) it to do, and I want it toalwaysbe the same regardless of whatever changes occur. Switch out AP for mesh: no, I don't want to relearn bloody DHCP implementations. FTTP instead of ADSL: why the hell should I have to retype 80 IP addresses in a 10-line HTML1 edit box?Well, you did ask

author: Halcyon
author_rank: Unknown
timestamp: February 05, 2025, 12:33:00 am
content: Quote from: PlainName on February 04, 2025, 09:09:38 amWhy not run it on your pfSense box? It's supported natively.Literally just a matter of going to System > Advanced > Networking > Select 'Kea DHCP' > Click 'Save'.Everything is still managed in the same place as it has always been (Services > DHCP Server).

author: PlainName
author_rank: Super Contributor
timestamp: February 05, 2025, 01:02:06 am
content: QuoteSeveral reasons I previously mentioned, but also I wasn't ware that it's Kea. In fact, I am pretty sure it isn't since the build isn't the current one.However, I am not saying I am going to do this or that (or, indeed, anything) and currently pondering options to figure out which is best for my circumstances. I dare say that in the end my decision will draw gasps from some and a few headshakes, but I am trying to please me and not the entire world. Still, even those suggestions I have rejected will have contributed in some way, so I thank everyone for taking the time to suggest stuff.

author: Halcyon
author_rank: Unknown
timestamp: February 05, 2025, 06:52:11 am
content: Quote from: PlainName on February 05, 2025, 01:02:06 amKea has been out for quite some time on pfSense. Over a year? So you may be running a very old build.My opinion is, keep it simple.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 05, 2025, 07:39:02 am
content: I agree with Halcyon: if you already have a router/switch/firewall that can support an adequate UI for your needs, use that. pfSense/OPNsense/OpenWRT should have several options to choose from.If I needed a superfast boot (in the single-digit seconds) for a DHCP server, I'd use a small Linux SBC/router with GbE, preferably with a small NVMe (for maximum 4k random read speed), with a custom init so it startsdnsmasq(DHCP and DNS cache) right after loading firewall settings (nftables), then openssh, and not much else. Not only does this mean the OS loads superfast because it is so tiny, but also the attack surface is minimal. Maintenance is minimal (due to the simplicity and most of the filesystem being read-only during normal operation), but config is done by editing files over SSH, so this is not what PlainName wants.

author: PlainName
author_rank: Super Contributor
timestamp: February 05, 2025, 10:07:14 am
content: Had a kip on this.Realised I was dead set against running a DHCP server in the router, not matter what it is. Reason: aforementioned separation of function and having to change unrelated processes because some other thing is replaced. Maybe that's a hangover from early days where the router was often needing rebooting, or changed seemingly every other month (got tons of them in the cupboard). Recent discussions of pfSense vs opsense don't help!But... the current setup has been in place for quite some time and I am happy with it. Sometimes the hardware dies and replacement is no longer available, so it gets restored onto something new, or the software is upgraded, and all the interfaces get different names and need sorting out. So that colours my view as well. Maybe it's not such a bad idea.One issue I have, regardless of what the replacement will be, is testing the thing. Not like I have 100 spare clients to shove on a spare network.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 05, 2025, 10:36:03 am
content: Quote from: PlainName on February 05, 2025, 10:07:14 amThat's what I like about raw dnsmasq config. DNS and DHCP in the same package, with a very simple configuration file format. It's nice that LAN names (especiallyname.local) Will Just Work even when internet is down. You can give clients IP addresses based on their MAC address, or based on the name they submit as part of DHCP requests. See thednsmasq.conf.example. In particular, note how you cantagMAC addresses, and then treat them as a group using that tag.Nice. It can even use/etc/ethersas the MAC - hostname mapping.The configuration file format is simple enough that if I only need to keep the dnsmasq etc. config files, I've got the name service documented.Quote from: PlainName on February 05, 2025, 10:07:14 amMost Linux ethernet drivers allow setting the MAC address at run time. That way, if you have a list of MAC addresses and/or names for your machines, you could test it with a single device. (The other end cannot tell it is a single host at the other end.) Annoyingly, it does require running command-line commands, though; the commands are quite simple, though, and it can all be scripted, too. You obviously cannot do this over SSH, so you do need an SBC or Linux machine with a display and keyboard.

author: PlainName
author_rank: Super Contributor
timestamp: February 05, 2025, 10:53:09 pm
content: Ran up latest versions of both opnsense and pfsense in VMs to check them out.With neither of them could I specify which type of client would be directed to which pool (the pools only seem to be there to allow for gaps in the address range). For instance, my default address range for DHCP is .100 to .159, but if the client User Class is 'ESP' then it gets an address in the range .160 to .252. Instead of User Class I can also use MAC range, Vendor Class, etc.So although Kea (and ISC - you can choose) are the bees knees, their implementations in the routers is basic. Surely I've missed something...

author: Halcyon
author_rank: Unknown
timestamp: February 06, 2025, 01:14:17 am
content: Quote from: PlainName on February 05, 2025, 10:53:09 pmThis begs the question... Why are you trying to do it this way? It seems highly unusual and aside from keeping 'classes of devices' neatly in different ranges, I fail to see what problem it's solving?Typically, if you have different devices that need to be segregated, either due to routing or firewall rules etc... VLANs are your answer. For example, for all my devices that don't require internet access (printers and such), they are on their own network. I can easily identify that either via the IP address e.g.: 10.32.x.y, or via the FQDN, e.g.: printer1.local.mydomain.com.

author: BradC
author_rank: Super Contributor
timestamp: February 06, 2025, 01:49:32 am
content: Quote from: Halcyon on February 06, 2025, 01:14:17 amSometimes it gets a bit complicated and there's no 'neat'. I have 3 subnets at home, and 2 DNS servers. I run the office from my granny flat.I want devices like the cameras, UPS, PDU.. and so on to be able to resolve local addresses but not resolve the world and absolutely not route the world.I want VM's (most) to do the same, but some need to be able to resolve the world, and access it only via a proxy. Some need unfettered access to the world. All need to be on the same interface (and thus IP range).I want day to day wired and wireless devices to be able to resolve the world, and access it via NAT.The first is easy. DHCP pool with local router and the restricted DNS.The second, not so much. I want a DHCP pool with local router and local DNS, except for certain MAC addresses where I want a either local/recursive DNS and/or local/NAT network.The third is a piece of cake.The second bit is the complicated one. I want any default VM to be restricted to the local only DNS and not routed to the world. I want some to be able to access the recursive DNS but not routed, and I want some others to have complete access. To do this requires a bit of trickery in the DHCP config to look at which MAC addresses are assigned which DNS and Router.This mostly came about because I caught Zimbra exfiltrating license data over DNS, but then it uses ClamAV which uses DNS to determine its database versions. Also Autodesk products, running on Microsoft products which love to try any way they can to phone home. There are micro-exceptions to these rules handled in both the DNS and firewall config. This would not fly without the ability to use DHCP to conditionally manage responses returned to clients.Sometimes VLANs aren't the answer, and this is why there are conditional elements to DHCP config. The problem for the OP is none of the GUIs allow for this stuff because it's such a rare corner case they'll never be able to cater for it.This is why I haven't migrated to Kea yet. Trying to figure out how to migrate the config across has been a nightmare, because while what I have works it's complex.Sometimes there is no "neat" solution.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 06, 2025, 08:37:25 am
content: Jeepers - I can see why you might want that degree of control and I admire the dedication in creating it but it sounds like a maintenance nightmare and certainly very difficult to move from a specific DHCP server implementation once you have got it all set up.Address ranges per client type seems overly complicated - why not do that as sub-nets then the "physical" network to which a client is attached defines a lot of the attributes you wish to control and it should make for an easier set-up in your router/firewall.You can almost certainly set this up with DNSMASQ in OpenWRT using tags, dhcp-options and dhcp-range, though you might lose some flexibility and I don't think setting up dhcp ranges is exposed in the GUIUnfortunately my notes on how to set this up and my "example implementation" are not to hand as they are in France but it is certainly possible to direct selected hosts to a specific gateway or DNS server.Manpage for dnsmasq here ->https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.htmlFull list of what you can set up in the configuration files here ->https://openwrt.org/docs/guide-user/base-system/dhcp

author: BradC
author_rank: Super Contributor
timestamp: February 06, 2025, 08:58:38 am
content: Quote from: grumpydoc on February 06, 2025, 08:37:25 amIt really is effectively subnet, and it's not as complex to administer as it sounds. Devices automatically get put where they are allocated, and once I had the logic set up it's just a matter of putting the MAC address in one of the exception pools where required.My biggest impediment to moving to Kea is just a total change in the way if/then/else and logic matches are made. I'll get there but it hasn't been a priority.I used bind9 as the recursive resolver and dnsmasq as the restricted one. In this scenario dnsmasq is just so easy and flexible it made sense. Anything that needs to recurse either does it on exxception through dnsmasq, or is given binds address from the get go.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 06, 2025, 09:21:35 am
content: Sorry Brad - I got you and PlainName confused for a second in terms of what you are trying to achieve and I think it was PlainName that mentioned different ranges per user class - that's certainly doable with dnsmasq as you can map the user class to a tag, then associate each range with a specific tag.Quote from: BradC on February 06, 2025, 08:58:38 amYeah - that was my first thought, my second was "why not do itasa subnet then" - as I said it will make for easier routing.QuoteIt is a surprisingly flexible and powerful DHCP server when you get into it.

author: PlainName
author_rank: Super Contributor
timestamp: February 06, 2025, 10:04:33 am
content: QuoteVLANs don't work over WiFi.

author: PlainName
author_rank: Super Contributor
timestamp: February 06, 2025, 10:07:37 am
content: QuoteYep, that's pretty much it. I'm either too complicated or the GUIs are too simple. Or both

author: grumpydoc
author_rank: Super Contributor
timestamp: February 06, 2025, 10:38:10 am
content: Quote from: PlainName on February 06, 2025, 10:04:33 amIsh - map each VLAN to a separate SSID

author: ksjh
author_rank: Regular Contributor
timestamp: February 06, 2025, 12:01:14 pm
content: Quote from: Nominal Animal on February 05, 2025, 10:36:03 amWhile I agree the dnsmasq is great for a lot of things, you might want to take a look atRFC 6762: Normally,.localis used for link-local Multicast DNS, which does not require a dedicated DNS server at all. Each machine is expected to reply to DNS queries for its assigned hostname sent to a specific (link-local) multicast group when using mDNS.

author: PlainName
author_rank: Super Contributor
timestamp: February 06, 2025, 12:04:37 pm
content: Quote from: grumpydoc on February 06, 2025, 10:38:10 amThat would rely on the AP doing that, and my ones don't. Or having a separate AP for each VLAN.

author: grumpydoc
author_rank: Super Contributor
timestamp: February 06, 2025, 12:10:22 pm
content: Better APs then, or OpenWRTIt should be doable, not actually tried it - as I said I managed my set-up by using the customisation of DHCP options which is configurable in dnsmasq so that I could point the relevant hosts at a different gateway device which then connects via a VPN.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 06, 2025, 01:02:38 pm
content: Quote from: ksjh on February 06, 2025, 12:01:14 pmI refuse to use.internalfor this, or Avahi, or Apple Bonjour, and also refuse to use mDNS, exactly because of this kind of fuckery. I used the.localdomain in NATs (that occasionally lost greater internet connection) way back in the late nineties; Apple and M. Krochmal and RFC 6762 be utterly fucked with a rusty spoon until they bleed from their anus for this.This is exactly what I hate about Apple/IBM/RedHat/Microsoft behaviour: they take an established practice, then fuck with it and twist it to their own semi-proprietary backwards-compatible crap. Apple knew.localwas already reserved but not standardized, so appropriated it for their mDNS. I'm sure Krochmal was congratulated for that particular move. Microsoft couldn't implement a proper LDAP server because their own security approach is so fucked up, they had to tweak it into Active Directory. IBM is using Red Hat to push AI into FreeDesktop.org and Gnome –– now that they have basically all distros fucked up with the single-point-of-failure security disaster called systemd and the subsystems it has metastasized into itself.Grr. Fuckers.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 06, 2025, 01:06:24 pm
content: For those who don't want a conflict with mDNS, use.homefor their internal domain not accessible from outside or the internet. It was rejected from use in 2012, and is thus not registrable as a valid DNS top-level domain. Until a big enough corporation appropriates this too, that is.

author: ksjh
author_rank: Regular Contributor
timestamp: February 06, 2025, 01:23:47 pm
content: Quote from: Nominal Animal on February 06, 2025, 01:06:24 pmThing is that most "modern" resolvers in most current operating systems/distros try to resolve.localvia mDNS by default anyway (at least they try first) until you disable it.

author: PlainName
author_rank: Super Contributor
timestamp: February 06, 2025, 01:25:53 pm
content: QuoteA couple of eons ago I settled on .home.net which works fine. Until there is a DNS issue, or some fuckwitted phone designer thinks Googles DNS should override local preferences, and then .home.net on the intertubes is found

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 06, 2025, 01:47:44 pm
content: Quote from: ksjh on February 06, 2025, 01:23:47 pmYeah, I just found that out. Having my own DHCP server with Avahi disabled on workstations made me miss it; I've never needed mDNS.Thing is, even though most Linux distros do these things, does not necessarily mean it makes any sense. For example, do you know why you still cannot select UTF-8 as your default character set in any web browser?It is because "UTF-8 is not a legacy character set" –– it is, in fact, theonlynon-legacy character set ––, and the browser developers decided that "only legacy character sets should be settable as the default". Does that make sense to you? It doesn't to me.(The actual definition theirs stemmed from is that any character set fully mapped and describable in Unicode is a legacy character set. By that definition, UTF-8isa legacy character set, as it can only describe Unicode code points U+0000 to U+10FFFF.)And my rants on systemd are not because there already exists something better that is a perfect drop-in, it is that the entire design approach is faulty, and its social status –– just see how often theDebian CTTEhas to step in to mediate because systemd-related/subsumed developers just don't want anyone else to encroach on their "turf" –– has essentially killed any development on alternatives. Sure, I can show you something technically better, but unless you get acommunityor IBM/RedHat-like deep pockets behind it, it just does not matter. In fact, showing something better would just shoot me in the head, because it would attract all sorts of people, mostly non-technical ones, driving away any technically interested developers. Havingusersis a burden; what one needs isdevelopment supportto get something better actually going.

author: ksjh
author_rank: Regular Contributor
timestamp: February 06, 2025, 02:37:32 pm
content: Quote from: PlainName on February 06, 2025, 01:25:53 pmBut I can see why this might not be so easy due to the hierarchical structure of DNS..netis a valid, resolvable TLD, and authorative name server for this TLD exists and needs to be contacted for every other domain ending in.net. And the root name server knows nothing about.home.net. I can imagine it to be hard to make this work reliably.

author: PlainName
author_rank: Super Contributor
timestamp: February 06, 2025, 02:51:17 pm
content: Quote from: ksjh on February 06, 2025, 02:37:32 pmYes, it was a long time ago and .net seemed to be the most appropriate TLD due to lack of hindsight at that time. I think it didn't exist externally either, then.Similar issues with local-only IP addresses. For simplicity I set up a client with a similar scheme to my own - they are meant to be localised, so what could possibly go wrong? And having the networks substantially the same (knowing what IP{ a server would be on, where the gateway is, etc.) was useful. Then VPNs came along and I needed to connect into their network to manage kit...

author: bingo600
author_rank: Super Contributor
timestamp: February 06, 2025, 03:36:31 pm
content: Quote from: Nominal Animal on February 06, 2025, 01:06:24 pmWasn't that changed to.home.arpa?https://datatracker.ietf.org/doc/html/rfc8375https://www.ctrl.blog/entry/homenet-domain-name.htmlAnd I totally agree onNEVERuse.local, it's going tobite your butMany OS'es treats .local as a "special domain", causing you all kind of grief later on.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 06, 2025, 05:05:49 pm
content: Quote from: bingo600 on February 06, 2025, 03:36:31 pmNo, that's just what Cisco tried to do to it, to appropriate it for their "HNCP" HomeNet protocol. It got too much opposition, so they switched HomeNet to treat.home.arpaas Their Special Domain instead.It is quite important that one does not allow their DNS cache to forward.homequeries to root name servers, to reduce unnecessary load. The reason it issafeto use locally is that ICANN has already rejected it as a top-level domain.For dnsmasq, uselocal=/home/(orlocal=/home/server-ip-addressfor caches referring to the main server), and it will look up any.homehostnames and subdomain hostnames (likehost.upstairs.home) only from the dnsmasq server/etc/hostsfile and dnsmasq's own DHCP configuration. That's all you need!I would definitely recommend looking at example dnsmasq configuration files, even perhaps creating one for your own network, before deciding that plain text file configuration is out. (dnsmasqis available in pfSense/OpnSense/OpenWRT.) I know a nice UI is nicer, but unless it is an UI that allows you to edit the config files in plain text () it won't let you do everything dnsmasq can do.Besides, if you keep a master copy of the config files, and just push (sftp/scp) them to the router followed by a network restart (no reboot needed, network service restart suffices; even TCP connections over the router won't break that way), you'll find it easier to migrate to different hardware – you always have the master copy of the config files at hand.One funky thing I've done with a couple of my OpenWRT dual-band routers with 5 Ethernet sockets, is bridge the 2.4GHz and 5GHz networks to the (guest/unsecure) LAN. It means that there is no way to send an IP packet from the wireless networks to the router itself (well, there is, the LAN interfaces, but the security-sensitive services do not bind to those, so won't receive such IP packets). The router (LuCi, SSH) only responds on a different subnet, enforced by kernel packet filters ("firewall"), and that is only accessible by a different ethernet socket on the router. You'll need some really funky bug in Linux kernel networking stack to break into that router, considering I usually don't keep that privileged ethernet socket normally connected to anything. I can still put DHCP/DNS using dnsmasq on the same router, because I can tell that to bind and answer on the WiFi/LAN addresses. Heh. On the other hand, the only thing "protecting" that LAN from unauthorized access via WiFi is WPA2/WPA3.Quote from: bingo600 on February 06, 2025, 03:36:31 pmYeah? I used.localfor local NAT domains before Windows even grew their own TCP/IP stack.Anyway,localhosthas always been special host name, always resolving to either the machine itself or its loopback IP address (usually 127.0.0.1 for IPv4, and ::1 for IPv6), and.localdomainis a special domain that resolves only locally, not forwarded by DNS resolvers. In other words,localhost.localdomainis a fully-qualified domain name that is resolved locally, not forwarded by any DNS resolver, and resolves to 127.0.0.1, ::1, or the IP address of the machine itself. (POSIXy/UNIXy systems use loopback address, because the machine itself does not have an IP address: the addresses are owned by the network interfaces, and each machine can have several of those. Mine often do.)Up till ten years ago (2013 or so),.localwas commonly used for local area networks serviced by their on DNS servers/caches, that did not forward it to root nameservers. This was not baked in to the services, it was just a common configuration. The mDNS folksmisappropriatedit for their own use, making it special. Bastards: I and many others used it for my own purposes for almost a decade before they got their crappy little hands on it. They knew that since it was only used by those who have their own DNS servers/caches, nobody would notice until it was way too late, since it only affected those who didn't and needed mDNS instead.

author: bingo600
author_rank: Super Contributor
timestamp: February 06, 2025, 05:21:35 pm
content: Quote from: Nominal Animal on February 06, 2025, 05:05:49 pmStrangeI see .home.arpa as an "Official special name"https://en.wikipedia.org/wiki/Special-Use_Domain_Namehttps://www.iana.org/domains/arpaAnd i "just" see .home as "Currently"QuoteRef:https://icannwiki.org/Name_CollisionWouldn't .home be "risky"Edit: Something new might be comming ... But why not .home or .lan instead of this long.internalnamehttps://www.icann.org/en/public-comment/proceeding/proposed-top-level-domain-string-for-private-use-24-01-2024https://en.m.wikipedia.org/wiki/.internalJust a draft for now..https://datatracker.ietf.org/doc/html/draft-davies-internal-tld-01Seems like .home was the "most referenced" on 2020.05.14 ( pg. 8 ) ... well besides .localhttps://itp.cdn.icann.org/en/files/security-and-stability-advisory-committee-ssac-reports/sac-113-en.pdf

author: madires
author_rank: Super Contributor
timestamp: February 06, 2025, 07:12:58 pm
content: Quote from: Nominal Animal on February 06, 2025, 05:05:49 pmI totally agree! Even Microsoft did recommend for a long time to use .local.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 06, 2025, 07:28:21 pm
content: Quote from: bingo600 on February 06, 2025, 05:21:35 pmReferring to RFC 8375,"This document specifies the behavior that is expected from the Domain Name System with regard to DNS queries for names ending with '.home.arpa.' and designates this domain as a special-use domain name. 'home.arpa.' is designated for non-unique use inresidential home networks. The Home Networking Control Protocol (HNCP) is updated to use the 'home.arpa.' domain instead of '.home'."by P. Pfister from Cisco Systems and T. Lemon from Nibbhaya Consulting, May 2018.In 2012, ICANN rejected top-level domain.home. Cisco originally wanted to appropriate that for HNCP, like Apple managed to do with.localand mDNS, but as the top level domain had already been rejected, eventually had to settle to.home.arpa, a subnet of the already-special.arpatop level domain. (Ask yourself, why didn't Apple get.mdnsor.local.arpafor Bonjour instead?)Thus, I'm specifically referring to the use of.homerejected top-level domain, not some special-use domain name.I do not give a flying fuck what you call your own local networks, as long as you configure it so that no DNS lookups will leak outside your network. Mine do not leak, because withdnsmasq, that is trivial to do, as I showed; and for test networks (especially VMs), I use plain/etc/hosts. You will also want to disable HTTPS-based DNS lookups in your browsers. (Those will ask Google's 8.8.8.8 servers about every hostname you use, so that Alphabet can better track you and will have a more complete profile of your activities to sell to advertisers.)The SAC113 you referred to (ICANN proposed TLD for private use), based on IANA's recommendation, ICANN is likely to standardize on.internalbeing the dedicated local network name that DNS resolvers will be politely asked to not delegate to root servers. The process is still ongoing, and IANA hasn't added.internalto thespecial use domain namesyet, and might not even if accepted. They're all waiting on IETF, I believe; their current draft ishere(02, from 2025-02-02).I won't be using.internalfor my networks, that's for sure. I'll also blackhole Alphabet's dns-over-https servers, I think; thus far I've just configured my browsers to not use those. I will use whatever I please, but I will also make sure others (especially root servers) won't get any leakage from me. Again, with dnsmasq, it is easy to do (except for dns-over-https, which applications may do to ignore host name services altogether).A lot of this is company politics..localwas lost to Apple/mDNS, somehow, even though even Microsoft used it for private local domain names, in addition to the thousands of NAT'ed local networks in labs across companies and universities. (I mean, the SAC113 background material shows > 5k queries per second about .local and .home tooneof the root nameservers.) The companies know.internalis too complicated for nontechnical folks to use, as they will confuse it with.internetif they recall it at all, so do not see it as a threat or becoming widely used. Just look at who voted/commented what in SAC113.It would be nice if someone bought a whole gTLD, and kept it empty, or directing everything to 127.0.0.1 and ::1 (i.e., loopback). Maybe.locior.lanor.hic–– the latter would be kinda funny.

author: Halcyon
author_rank: Unknown
timestamp: February 20, 2025, 05:29:20 am
content: Quote from: Nominal Animal on February 06, 2025, 01:06:24 pmIdeally it should be .home.arpa as that is specifically reserved under RFC 8375. You could also use .local but typically that's used for link-local networking and mDNS. Both are designated "special use" TLDs and will never be registered on the internet..home could also be used, but it's not part of any standards. Applications have just been rejected by ICANN indefinitely.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 20, 2025, 06:37:46 am
content: Quote from: Halcyon on February 20, 2025, 05:29:20 amAre you winding me up, or didn't you just "have time" to read my responses to that suggestion above?