"Recent posts
#1
General Discussion / Re: Virtual IP/NAT/Virtual Mac...
Last post by dsnyc - Today at 01:03:06 AMThe HYPER-V NIC that connects to the physical opensense firewall is assigned a LAN IP of 192.168.251.1 for example. This gives the HYPER-V host access to the Internet. The HYPER-V Opensense VM has the same HYPER-V NIC connected as it's WAN interface. I need to be able to have traffic to the Virtual IP to go to the WAN IP of the HYPER-V Virtual Machine Opensense. Not sure how to do this.
#2
26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...
Last post by (MARLOO) - Today at 12:44:01 AM@Patrick M. Hausen
I understand your point: in a carefully maintained DNS zone, dynamic client names would be unwanted noise.
In my home lab, however, dynamic registration is a deliberate convenience. It lets me reach laptops, VMs, phones and IoT devices by name without maintaining a static DNS entry for every temporary client.
Being able to resolve client hostnames is also useful for SSH, SMB, printing, Home Assistant integrations, remote access, and quickly reaching a VM or laptop without looking up its current IP.
For servers, infrastructure and services that need stable names or certificates, I agree that explicit static DNS records are the right approach. So it is not really Dnsmasq versus Kea: it is whether you want automatic client-name registration or a clean, manually managed DNS zone.
I will stay with Dnsmasq, but use static records for the important services and infrastructure.
Both approaches are valid; yours is probably the better fit for a production-like DNS environment, while mine is the better fit for a frequently changing home lab.
I understand your point: in a carefully maintained DNS zone, dynamic client names would be unwanted noise.
In my home lab, however, dynamic registration is a deliberate convenience. It lets me reach laptops, VMs, phones and IoT devices by name without maintaining a static DNS entry for every temporary client.
Being able to resolve client hostnames is also useful for SSH, SMB, printing, Home Assistant integrations, remote access, and quickly reaching a VM or laptop without looking up its current IP.
For servers, infrastructure and services that need stable names or certificates, I agree that explicit static DNS records are the right approach. So it is not really Dnsmasq versus Kea: it is whether you want automatic client-name registration or a clean, manually managed DNS zone.
I will stay with Dnsmasq, but use static records for the important services and infrastructure.
Both approaches are valid; yours is probably the better fit for a production-like DNS environment, while mine is the better fit for a frequently changing home lab.
#3
26.7 Series / Re: [SOLVED] Kea DHCP vs Dnsma...
Last post by Patrick M. Hausen - Today at 12:26:52 AMI use Kea and Unbound because it's simpler. I don't want dynamic DHCP clients polluting my carefully maintained DNS zone. Why would I want "Paddys-Macbook-Pro" in my DNS? DNS entries are for servers that need to be reachable by clients, have certificates, etc.
My approach. Yours is different.
My approach. Yours is different.
#4
26.7 Series / Re: Kea DHCP vs Dnsmasq DHCPv4...
Last post by (MARLOO) - October 12, 2026, 11:54:13 PMThanks both for confirming.
That was exactly the conclusion I was leaning towards: for a single-firewall, multi-VLAN home lab without HA, RFC 2136 DDNS or advanced DHCPv6 requirements, Dnsmasq's integrated DNS/DHCP/RA behaviour is more practical than gaining Kea's API and HA features.
I'll stay with Dnsmasq and revisit Kea only if I later deploy a second OPNsense firewall or need API-driven DHCP automation.
That was exactly the conclusion I was leaning towards: for a single-firewall, multi-VLAN home lab without HA, RFC 2136 DDNS or advanced DHCPv6 requirements, Dnsmasq's integrated DNS/DHCP/RA behaviour is more practical than gaining Kea's API and HA features.
I'll stay with Dnsmasq and revisit Kea only if I later deploy a second OPNsense firewall or need API-driven DHCP automation.
#5
26.7 Series / Re: Kea DHCP vs Dnsmasq DHCPv4...
Last post by nero355 - October 12, 2026, 11:34:24 PMQuote from: (MARLOO) on October 12, 2026, 08:48:36 PMI am evaluating whether Kea DHCP would give me any real advantage for my setup.I would say you have perfectly done your homework and there is not much/nothing to add to what you know so far :)
#6
Development and Code Review / Re: 26.7.5 git tag for src rep...
Last post by none - October 12, 2026, 11:13:16 PMHello,
for the record, 26.7.6 builds fine.
Thanks,
none
for the record, 26.7.6 builds fine.
Thanks,
none
#7
General Discussion / Re: opnsense wont boot on APU2...
Last post by viragomann - October 12, 2026, 10:57:47 PM/conf/config.xml
Former versions are stored in /conf/backup/.
Former versions are stored in /conf/backup/.
#8
General Discussion / Re: opnsense wont boot on APU2...
Last post by robertkwild - October 12, 2026, 10:34:20 PMAnd if I do manage to mount the data, what file path am I looking for to backup my config
#9
26.7 Series / Re: Kea DHCP vs Dnsmasq DHCPv4...
Last post by Patrick M. Hausen - October 12, 2026, 09:13:34 PMNo.
#10
26.7 Series / [SOLVED] Kea DHCP vs Dnsmasq:w...
Last post by (MARLOO) - October 12, 2026, 08:48:36 PMHi,
I am currently using Dnsmasq for DHCP and DNS on my OPNsense home lab, with a LAN and several VLANs. Everything is working fine.
I am evaluating whether Kea DHCP would give me any real advantage for my setup. I only want to understand the concrete benefits of Kea compared with Dnsmasq DHCPv4.
An important difference is DNS integration. Dnsmasq is a combined DNS, DHCP and Router Advertisement service: it can resolve and cache DNS queries, provide Router Advertisements, and dynamically register DHCP client hostnames in Unbound.
Kea is DHCP-only. It can advertise DNS servers to clients through DHCP options, but it does not provide a DNS resolver/cache, Router Advertisements, or dynamic hostname registration in Unbound. With Kea, Unbound and radvd are still required for a full DNS/DHCP/RA setup.
Kea does have a DDNS Agent, but it only sends RFC2136 updates to an authoritative DNS server such as BIND or PowerDNS. Recursive DNS servers such as Dnsmasq or Unbound cannot be used as the target for those updates.
For a home lab with a few VLANs, fewer than 1000 clients, no HA pair, no RFC2136 DDNS and no complex PXE/IPv6 requirements, I see no practical advantage in switching from Dnsmasq to Kea.
The only concrete advantages I can identify are:
1. Deleting individual leases from the GUI through the Control Agent.
2. API-based DHCP management/automation.
3. HA with lease synchronization, if I later deploy a second OPNsense firewall.
4. More advanced DHCPv6 Prefix Delegation and conditional DHCP options.
I also saw a recent thread where static Dnsmasq reservations did not seem to work for some devices, possibly because of DUID-based client identification or an old dynamic lease that was never released. However, that is not the main reason for my question.
So, my question is: does Kea offer any real advantage for a multi-VLAN home lab compared with Dnsmasq DHCPv4, especially considering that Kea does not provide DNS, Router Advertisements or dynamic hostname registration in Unbound?
Thanks.
I am currently using Dnsmasq for DHCP and DNS on my OPNsense home lab, with a LAN and several VLANs. Everything is working fine.
I am evaluating whether Kea DHCP would give me any real advantage for my setup. I only want to understand the concrete benefits of Kea compared with Dnsmasq DHCPv4.
An important difference is DNS integration. Dnsmasq is a combined DNS, DHCP and Router Advertisement service: it can resolve and cache DNS queries, provide Router Advertisements, and dynamically register DHCP client hostnames in Unbound.
Kea is DHCP-only. It can advertise DNS servers to clients through DHCP options, but it does not provide a DNS resolver/cache, Router Advertisements, or dynamic hostname registration in Unbound. With Kea, Unbound and radvd are still required for a full DNS/DHCP/RA setup.
Kea does have a DDNS Agent, but it only sends RFC2136 updates to an authoritative DNS server such as BIND or PowerDNS. Recursive DNS servers such as Dnsmasq or Unbound cannot be used as the target for those updates.
For a home lab with a few VLANs, fewer than 1000 clients, no HA pair, no RFC2136 DDNS and no complex PXE/IPv6 requirements, I see no practical advantage in switching from Dnsmasq to Kea.
The only concrete advantages I can identify are:
1. Deleting individual leases from the GUI through the Control Agent.
2. API-based DHCP management/automation.
3. HA with lease synchronization, if I later deploy a second OPNsense firewall.
4. More advanced DHCPv6 Prefix Delegation and conditional DHCP options.
I also saw a recent thread where static Dnsmasq reservations did not seem to work for some devices, possibly because of DUID-based client identification or an old dynamic lease that was never released. However, that is not the main reason for my question.
So, my question is: does Kea offer any real advantage for a multi-VLAN home lab compared with Dnsmasq DHCPv4, especially considering that Kea does not provide DNS, Router Advertisements or dynamic hostname registration in Unbound?
Thanks.
