Messages

@miracuru
I finally got the conversion of  opnsense isc  static lease to opnsense kea reservation working.
It was a one line change  to my original posted script.
I will post it tomorrow on GitHub.

From the opnsense config .xml
The python script reads a cut&paste that contains the isc dhcp static lease. Need to add ur subnet uuid to the python code prior to execution.

Code Select Expand


<dhcpd>
    <lan>
      <enable>1</enable>
      <ddnsdomainalgorithm>hmac-md5</ddnsdomainalgorithm>
      <numberoptions>
        <item/>
      </numberoptions>
      <range>
        <from>10.59.11.200</from>
        <to>10.59.11.245</to>
      </range>
      <winsserver/>
      <dnsserver/>
      <ntpserver/>
      <staticmap>
        <mac>a1:b1:c1:d1:e1:f1</mac>
        <ipaddr>10.59.11.100</ipaddr>
        <hostname>DAD-DESKTOP</hostname>
        <descr>DAD-DESKTOP</descr>
        <winsserver/>
        <dnsserver/>
        <ntpserver/>
      </staticmap>
        <staticmap>
        <mac>a2:b2:c2:d2:e2:f2</mac>
        <ipaddr>10.59.11.101</ipaddr>
        <hostname>MOM-DESKTOP</hostname>
        <descr>MOM-DESKTOP</descr>
        <winsserver/>
        <dnsserver/>
        <ntpserver/>
      </staticmap>
    </lan>
  </dhcpd>


And writes a file that contains the conversion to kea dhcp reservations:

Code Select Expand


          <reservation uuid="c7495e59-000b-4bf3-b083-0d35f099e946">
            <subnet>4e3016b1-b603-44bd-a361-b33c44333c98</subnet>
            <ip_address>10.59.11.100</ip_address>
            <hw_address>a1:b1:c1:d1:e1:f1</hw_address>
            <hostname>DAD-DESKTOP</hostname>
            <description>DAD-DESKTOP</description>
          </reservation>
          <reservation uuid="c82430df-45c7-4d9b-b11b-22f228af7e02">
            <subnet>4e3016b1-b603-44bd-a361-b33c44333c98</subnet>
            <ip_address>10.59.11.101</ip_address>
            <hw_address>a2:b2:c2:d2:e2:f2</hw_address>
            <hostname>MOM-DESKTOP</hostname>
            <description>MOM-DESKTOP</description>
          </reservation>


Here is the link to GitHub for the .xml conversion of pfsense isc-dhcp static lease to opnsense kea-dhcp reservation info.

https://github.com/patrick0525/Python-Pf-isc-Opn-kea
Run the Python code with sample pfsense .xml data.

@miracuru
I wrote python code (windows) that will generate random uuid per device and saves the output  to abc.txt
Just modify the the directory path of the output_file
>>> python3 uuid3.py

Code Select Expand


import uuid
output_file = open(r'C:\Users\patri\Documents\python\abc.txt', 'w')

devices =  ["dev1", "dev2","dev3"]
for x in devices:
    u = uuid.uuid4()
    print(x, ": ",u)
    #output_file.writelines(x, ": ",u)
    output_file.writelines(f"{'':>10}{x}{":  "}{u}{"\n"}")
# Close file
output_file.close()

# Checking if the data is written to file or not
output_file = open(r'C:\Users\patri\Documents\python\abc.txt', 'r')   
print("Read the saved file:  \n")
print(output_file.read())
output_file.close()


Code Select Expand


abc.txt
          dev1:  298007e3-2244-42cc-a9d7-bcf15b6d6de0
          dev2:  8b59170a-b013-46d5-bb3e-31c6529b7299
          dev3:  a22907f6-0e6c-4779-bf2a-7794c72f1c8f


I wrote a python program that takes my pfsense isc-dhcp static lease and converts it into a opnsense kea dhcp reservations xml format. I had 40+ pfsense static leases that I didn't want to  re-enter into the opnsense gui. The python script uses uuid4 , a random generated uuid and has a hyphen format. I will try to upload to a GitHub repo. Stay tune.

I am currently using a vpn via Wireguard. It works great.
Zenarmor is assigned to the lan. What should Suricata (IDS)  be assigned to : the wan or the wireguard_interface?
Under the IDS advanced mode, do I need to modify home networks? The helps says  "Networks to interpret as local", what does that mean?

Does the isc dhcp static lease assignments get copied over to the kea static leases as reservations when you enable  kea dhcp?

Okay, I will try to get it to GitHub with some sample data.

Update: https://github.com/patrick0525/Python-Opnsense

This use case converts pfsense isc-dhcp static leases xml to an opnsense kea-dhcpstatic lease xml. The pfsense isc and opnsense kea xml config are different. It is a limited conversion focused on DHCP static leases and saves the manual entry time into the kea gui.

Is there interest to post the two python scripts and the outputs?

I can manually create a DHCP static lease or a KEA reservation per device. But how do I avoid entering each device's MAC address etc via the GUI? I already have that info in a pfsense config .xml file. Yes pfsense. In addition, opnsense's  .xml KEA DHCP section also needs a reservation and subnet uuid per device. Is there a tool to generate these values?

Assigning a static ip and then do kea dhcp migration worked!

Newsense. Thanks I will give it a try.

Thanks. I guess during opnsense kea and isc configuration the client needs to have a static ip address and then switch later to a dynamic dhcp to verify that kea is being a dhcp server. Am I correct?

I read the kea documents and I set my kea pool range to 10.59.11.215 to .220
But it still pickup the isc-dhcp static lease lan at  10.59.11.200. Both isc and kea are using the same lan interface.
Are there any good procedures?

Not to hijack, I am on a wireguard_interface and not wan. Eicar does not drop or send alerts. There is something wrong with Suricata. Just wan and no wireguard vpn connection, eicar works fine.

I also get

App-Layer protocol rdp enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.