"Recent posts
#1
26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...
Last post by Netlearn - Today at 04:08:48 AMThanks @(MARLOO) for your post explaining the main points on how to choose from dnsmasq and KEA.
I wish I could have read an explanation so concise and clear years ago. I think it will be very useful to others.
I wish I could have read an explanation so concise and clear years ago. I think it will be very useful to others.
#2
26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...
Last post by (MARLOO) - Today at 01:17:19 AMQuote from: passeri on Today at 12:50:14 AMQuote from: (MARLOO) on October 12, 2026, 11:54:13 PMThat was exactly the conclusion I was leaning towardsYes, you argued it in your opening post. For this reason I disagree with @nero355 that your post might be useful as implicitly standalone advice in Opnsense documentation. As one of the options, of course it lays out a valid position. However, one does not need to be in a production environment or launch a thousand devices to find Kea / Unbound an optimal solution for home needs. Patrick put the basics of that clearly.
It depends on the user, not the system.
You are right about the general point, and I agree.
My post reflects my own use case and preferences, not a general recommendation. Dnsmasq is convenient for me because I want DHCP client hostnames to be automatically resolvable through Unbound, along with integrated Router Advertisements.
@nero355 did suggest that the post could be added to the documentation or published elsewhere as a reference. However, I agree that it should not be presented as standalone advice: the best choice depends on the user's preferred DNS/DHCP workflow.
Kea plus Unbound can absolutely be an excellent solution for a home network as well, especially for users who prefer a clean, manually maintained DNS zone without dynamic client names.
I have clarified this in the FAQ to avoid giving the impression that Dnsmasq is automatically the better choice for home use.
#3
26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...
Last post by passeri - Today at 12:50:14 AMQuote from: (MARLOO) on October 12, 2026, 11:54:13 PMThat was exactly the conclusion I was leaning towardsYes, you argued it in your opening post. For this reason I disagree with @nero355 that your post might be useful as implicitly standalone advice in Opnsense documentation. As one of the options, of course it lays out a valid position. However, one does not need to be in a production environment or launch a thousand devices to find Kea / Unbound an optimal solution for home needs. Patrick put the basics of that clearly.
It depends on the user, not the system.
#4
26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...
Last post by (MARLOO) - Today at 12:07:05 AMQuote from: nero355 on October 13, 2026, 02:49:54 PMIMHO your first post could be easily added to the OPNsense Documentation or perhaps you could put it online somewhere like GitHUB ?
It would be easy to point people to when they ask what to use or maybe still need to migrate from ISC to one of them!
Thanks for the suggestion. I have created a post and added it to the FAQs.
It is only intended as a concise summary of the main practical differences between Dnsmasq and Kea, not as a complete guide. I hope it can be useful as a quick reference.
https://forum.opnsense.org/index.php?topic=53150.0
#5
Tutorials and FAQs / [Guide] Dnsmasq vs Kea DHCP o...
Last post by (MARLOO) - October 13, 2026, 11:59:34 PMDnsmasq and Kea are related but solve different problems.
--Dnsmasq-- is an all-in-one service: DNS forwarding/caching, DHCPv4/DHCPv6 and Router Advertisements.
--Kea-- is a dedicated DHCP server only.
They are not direct replacements for each other: Dnsmasq is ideal for a simple integrated setup, while Kea is useful when you need more advanced DHCP features.
*** Key differences ****
Both Dnsmasq and Kea can provide DHCPv4 and DHCPv6, but their additional features are quite different.
---Dnsmasq provides:--
- DNS forwarding and caching
- Router Advertisements for IPv6
- Dynamic registration of DHCP client hostnames in Unbound
- A simple integrated DNS/DHCP/RA setup
- Basic DHCPv6 and conditional DHCP options
--Kea provides:--
- API-based DHCP management and automation
- Lease management through the Control Agent
- DHCP high availability with lease synchronization
- More advanced DHCPv6 Prefix Delegation and conditional DHCP options
- RFC 2136 DDNS updates to an authoritative DNS server, such as BIND or PowerDNS
## DNS is the main difference ##
Dnsmasq can resolve and cache DNS queries, provide Router Advertisements and dynamically register DHCP client hostnames in Unbound.
Kea can advertise DNS servers to clients through DHCP options, but it does not provide a DNS resolver/cache, Router Advertisements or dynamic hostname registration in Unbound.
Kea's DHCP-DDNS component sends RFC 2136 updates to an authoritative DNS server, such as BIND or PowerDNS. It cannot use Unbound or Dnsmasq as the DDNS target.
With Kea, you still need Unbound for DNS and `radvd` for Router Advertisements if you use IPv6.
------ Use Dnsmasq when
- You have one OPNsense firewall.
- You have a LAN and a few VLANs.
- You want DNS, DHCP and Router Advertisements in one service.
- You want DHCP client hostnames to be resolvable in Unbound.
- You do not need DHCP HA, API automation or advanced DHCPv6 features.
This is the usual choice for a home lab or small network.
--------Use Kea when
- You need API-driven DHCP automation.
- You need lease management through the Control Agent.
- You need DHCP high availability with lease synchronization.
- You need advanced DHCPv6 Prefix Delegation or conditional DHCP options.
- You prefer a clean, manually maintained DNS zone without dynamic client names.
------Bottom line
Both Dnsmasq and Kea can be valid choices for a home network.
Use --Dnsmasq-- if you prefer an integrated DNS/DHCP/RA setup and want DHCP client hostnames to be automatically resolvable in Unbound.
Use --Kea-- if you prefer a dedicated DHCP server, API-based management, DHCP HA or a clean, manually maintained DNS zone without dynamic client names.
The best choice depends on your preferred DNS/DHCP workflow, not simply on whether the network is a home lab or a production environment.
See the original forum discussion here:
https://forum.opnsense.org/index.php?topic=53140.0
Note: This post is only intended to outline the main practical differences between Dnsmasq and Kea. It is not an official guide, a migration guide or a complete feature comparison.
--Dnsmasq-- is an all-in-one service: DNS forwarding/caching, DHCPv4/DHCPv6 and Router Advertisements.
--Kea-- is a dedicated DHCP server only.
They are not direct replacements for each other: Dnsmasq is ideal for a simple integrated setup, while Kea is useful when you need more advanced DHCP features.
*** Key differences ****
Both Dnsmasq and Kea can provide DHCPv4 and DHCPv6, but their additional features are quite different.
---Dnsmasq provides:--
- DNS forwarding and caching
- Router Advertisements for IPv6
- Dynamic registration of DHCP client hostnames in Unbound
- A simple integrated DNS/DHCP/RA setup
- Basic DHCPv6 and conditional DHCP options
--Kea provides:--
- API-based DHCP management and automation
- Lease management through the Control Agent
- DHCP high availability with lease synchronization
- More advanced DHCPv6 Prefix Delegation and conditional DHCP options
- RFC 2136 DDNS updates to an authoritative DNS server, such as BIND or PowerDNS
## DNS is the main difference ##
Dnsmasq can resolve and cache DNS queries, provide Router Advertisements and dynamically register DHCP client hostnames in Unbound.
Kea can advertise DNS servers to clients through DHCP options, but it does not provide a DNS resolver/cache, Router Advertisements or dynamic hostname registration in Unbound.
Kea's DHCP-DDNS component sends RFC 2136 updates to an authoritative DNS server, such as BIND or PowerDNS. It cannot use Unbound or Dnsmasq as the DDNS target.
With Kea, you still need Unbound for DNS and `radvd` for Router Advertisements if you use IPv6.
------ Use Dnsmasq when
- You have one OPNsense firewall.
- You have a LAN and a few VLANs.
- You want DNS, DHCP and Router Advertisements in one service.
- You want DHCP client hostnames to be resolvable in Unbound.
- You do not need DHCP HA, API automation or advanced DHCPv6 features.
This is the usual choice for a home lab or small network.
--------Use Kea when
- You need API-driven DHCP automation.
- You need lease management through the Control Agent.
- You need DHCP high availability with lease synchronization.
- You need advanced DHCPv6 Prefix Delegation or conditional DHCP options.
- You prefer a clean, manually maintained DNS zone without dynamic client names.
------Bottom line
Both Dnsmasq and Kea can be valid choices for a home network.
Use --Dnsmasq-- if you prefer an integrated DNS/DHCP/RA setup and want DHCP client hostnames to be automatically resolvable in Unbound.
Use --Kea-- if you prefer a dedicated DHCP server, API-based management, DHCP HA or a clean, manually maintained DNS zone without dynamic client names.
The best choice depends on your preferred DNS/DHCP workflow, not simply on whether the network is a home lab or a production environment.
See the original forum discussion here:
https://forum.opnsense.org/index.php?topic=53140.0
Note: This post is only intended to outline the main practical differences between Dnsmasq and Kea. It is not an official guide, a migration guide or a complete feature comparison.
#6
26.7 Series / Re: Router Dead After Latest U...
Last post by (MARLOO) - October 13, 2026, 11:37:12 PMPositive report: 26.7.6 -> 26.7.7 update completed successfully via the GUI.
After reboot:
- opnsense-version reports OPNsense 26.7.7 (amd64)
- No kernel panic, segfault or Hyper-V-related errors in dmesg
- pf is running and has active states
- DNS and WAN connectivity are working
- configd, Unbound, dhcpd, watchfrr, mgmtd and zebra are running
- FRR: watchfrr is running
The only matching line in the system log was the expected controlled
termination of ppp during the service restart:
ppp ... caught fatal signal TERM
No issues observed so far after the update.
After reboot:
- opnsense-version reports OPNsense 26.7.7 (amd64)
- No kernel panic, segfault or Hyper-V-related errors in dmesg
- pf is running and has active states
- DNS and WAN connectivity are working
- configd, Unbound, dhcpd, watchfrr, mgmtd and zebra are running
- FRR: watchfrr is running
The only matching line in the system log was the expected controlled
termination of ppp during the service restart:
ppp ... caught fatal signal TERM
No issues observed so far after the update.
#7
26.7 Series / Re: Gradual Internet Performan...
Last post by tonys - October 13, 2026, 10:15:05 PMQuote from: Patrick M. Hausen on October 13, 2026, 09:44:10 PMQuote from: tonys on October 13, 2026, 09:28:48 PM<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9
Out of memory?
No, not at all. I have 14GB free ram of the installed 16GB. I managed to reboot via the GUI. I waited 5 minutes after the Login page came up and the first attempt to log in failed with a page timeout error. I tried a second time and the Dashboard finally came up but was completely blank. A few minutes later, it finally populated. Overall, the web GUI is EXTREMELY slow. I checked the Unbound configuration and all my settings were wiped out in the GUI yet it is running based on my check command: dig +short txt proto.on.quad9.net. I just reloaded the Dashboard page and it went blank for almost 10 minutes!
#8
26.7 Series / Re: Gradual Internet Performan...
Last post by Patrick M. Hausen - October 13, 2026, 09:44:10 PMQuote from: tonys on October 13, 2026, 09:28:48 PM<27>1 2026-10-13T14:15:46-05:00 OPNsense.home.lan lighttpd 15457 - [meta sequenceId="1"] (/usr/obj/usr/ports/www/lighttpd/work/lighttpd-1.4.85/src/gw_backend.c.384) child signalled: 9
Out of memory?
#9
26.7 Series / Re: Deny or Isolate any and al...
Last post by Patrick M. Hausen - October 13, 2026, 09:40:21 PMYou can still - and possibly your ISP router did not do more than that - disable DHCP for unknown MAC addresses and add all clients explicitly and statically. While not a strong security measure against an experienced attacker it will still puzzle the occasional wardriver who somehow got hold of your WiFi secret. It will also keep out phones that change MAC addresses as a privacy measure etc. until you configure them to not do that.
People with the correct secret can still authenticate to your WiFi, try to catch some broadcast traffic, and give themselves a static IP address. But it's better than nothing.
Best if combined with client isolation on your access point.
People with the correct secret can still authenticate to your WiFi, try to catch some broadcast traffic, and give themselves a static IP address. But it's better than nothing.
Best if combined with client isolation on your access point.
#10
26.7 Series / Re: Deny or Isolate any and al...
Last post by Monviech (Cedrik) - October 13, 2026, 09:39:31 PMYou could look into the zenarmor plugin I think it can whitelist new devices. But not an expert with it.
Good luck :)
Good luck :)
