ISC DHCPv4 Static Button throws PHP error

[borito]

Since latest update to 26.7.1, I cannot add Static IPs using the '+' sign on the console of ISC DHCPv4.

I get thrown an error as below:

Deprecated: The backtick (`) operator is deprecated, use shell_exec() instead in /usr/local/www/services_dhcp_edit.php on line 312

I have edited the file removing the (') and adding shell_exec() but still failing (?)

[Monviech (Cedrik)]

Best use KEA now, it's pretty much feature complete in the GUI.

The ISC plugin is legacy since a while now and EOL.

[Matthew_Kent]

Does unbound DNS register KEA leases now?

[Monviech (Cedrik)]

It registers static leases, aka if you created a DHCP reservation it will register that.

For dynamic leases, no, and it's not planned to fix that.

You can use RFC2136 though, either with the community bind plugin or soon with the business edition's powerdns plugin when that's released (will be in the next business version).

Or you can find some community maintained scripts on github if you trust those.

[Matthew_Kent]

Thanks, will take a look at os-bind

[tessus]

The ISC plugin is legacy since a while now and EOL.

I am sorry. KEA is unusable without registering dynamic leases. Period. There is no other way to say this. If you need that functionality (which is why most people who need it either still use ISC (like myself) or migrate to DNSmasq, KEA is utterly useless. And it will stay that useless, unless there is a workaround (as you mentioned via a community plugin or the powerdns plugin). However without proper documentation (how to transition your perfect ISC setup to KEA + plugin + whatever (w/o losing any features/functionality)) this is also just a theory.

It was mentioned back then that ISC will still work, which I guess should have read "it will still work, until it doesn't, and then you are screwed".

Please forgive my disappointment, but it is still hard to grasp how a project can replace one of the most important subsystems of a router (OPNsense's main purpose is still a firewall/router, is it not?) with something that is useless out of the box.
Having access to your devices via DNS in your home network is one of the most important things. Sorry, but some people use DHCP instead of fixed IP addresses.

But maybe the scorching heat is just ravaging and melting my brain. Right now I can't tell. (In which case I apologize in advance.)

[Patrick M. Hausen]

There are/were commercially succesful firewalls that did not bring a DHCP server at all. After all that's supposed to run on your Windows domain controllers in your enterprise with a couple of thousand seats.

Seriously, though - if a device needs a name to be accessed, i.e. provides a service of any kind, it gets a fixed IP address in my home network. Case closed or is it? Why would I want "Paddy's Macbook Pro" or "Gabi's iPad" anywhere in my DNS records? I fail to see the use case. Plus there is mDNS almost everywhere today.

P.S. Plus for a home setup and if you expect Fritzbox equivalent behaviour, you can always use DNSmasq, if I am not mistaken. I prefer Kea, because for me DNSmasq throws too many functions/roles into a single product.

[Monviech (Cedrik)]

In the business edition we will soon have a PowerDNS based plugin. So if you use that, you will have full KEA RFC2136 support in the same support tier as all other opnsense core products.

This is the only clean way, RFC2136 requires an authoritative nameserver, Unbound is by design just a forwarder and whatever scripts you throw at it is less than optimal to emulate authoritative nameserver behavior.

https://github.com/opnsense/docs/blob/opndns/source/vendor/deciso/opndns.rst

Tools from experts for experts :)
(Also with proper HA support, which would be a challenge with KEA otherwise)

[tessus]

After all that's supposed to run on your Windows domain controllers in your enterprise with a couple of thousand seats.

What is Windows?

Seriously, though - if a device needs a name to be accessed, i.e. provides a service of any kind, it gets a fixed IP address in my home network. Case closed or is it?

Yes, I do this as well. All my VMs/LXCs and physical machines who provide a service use either a static IP address (rarely) or a static DHCP mapping (frequently).

Why would I want "Paddy's Macbook Pro" or "Gabi's iPad" anywhere in my DNS records? I fail to see the use case.

Especially in test environments or prod envs with ephemeral VMs/LXCs that need to talk to each other a dynamic mapping is very helpful. Of course one can create scripts to manage static mappings or assign static IPs, but it's a matter of convenience. In most cases I don't care about Paddy's MacBook or Gabi's iPad. Unless I want to transfer data and there is no mDNS available. But I agree... this is not very likely.

My main point was rather that I have a perfectly working env right now. As soon as I migrate to 26.7, my setup will break and I will have to migrate to DNSmasq - whether I want or not. Don't get me wrong, it was clear to me that I would have to migrate at one point in the future. But I hoped it would not be so soon. And I am just disappointed that something that has worked perfectly will stop working.

In the business edition we will soon have a PowerDNS based plugin.

Will this be available for the community edition?

PowerDNS is awesome. I worked for one of the biggest domain resellers and administered a few PowerDNS clusters... However, this seems a bit of an overkill for my home network. Haha.

[Monviech (Cedrik)]

No, its only planned for the business edition (the plugin), the binary itself is freely available though, but of course without the GUI nicities (we really worked hard on making that GUI nice).

For community the focus is on dnsmasq as it can do everything a home network needs in a single package.

I also worked with powerdns clusters before, synchronized over mariadb for ISP purposes. So I knew that tool is great, also it's NL based which is a win for europe in general.

[nero355]

Seriously, though - if a device needs a name to be accessed, i.e. provides a service of any kind, it gets a fixed IP address in my home network. Case closed or is it?

Almost...

Why would I want "Paddy's Macbook Pro" or "Gabi's iPad" anywhere in my DNS records?
I fail to see the use case.

Because we need to know if there has been naughty traffic from our Clients or not, so we give them all a nice Local DNS Record in Pi-Hole that points to their IP Address that's a nice Static DHCP Mapping based on the MAC Address in KEA :)

Don't you have that too so your AdGuard Query Logging is easier to use ?!

Plus there is mDNS almost everywhere today.

IMHO that's just annoying unnecessary noise on my network :(

I disable it where ever I see no use for it!

P.S. Plus for a home setup and if you expect Fritzbox equivalent behaviour, you can always use DNSmasq, if I am not mistaken. I prefer Kea, because for me DNSmasq throws too many functions/roles into a single product.

DNSmasqd is AWESOME!!! and full of wonderful features that become even better when you use Pi-Hole's FTLDNS which adds additional code on top of it :)

What is Windows?

MWAHAHA!!! NICE! ^_^

My main point was rather that I have a perfectly working env right now.

As soon as I migrate to 26.7, my setup will break and I will have to migrate to DNSmasq - whether I want or not.

Don't get me wrong, it was clear to me that I would have to migrate at one point in the future. But I hoped it would not be so soon. And I am just disappointed that something that has worked perfectly will stop working.

It's not that bad at all actually :

- The ISC DHCP Server has been moved to a plug-in which will keep working for a long time from what I have read so far.
- Nothing will break when moving to 26.7 because you are upgrading and not performing a fresh install !!
- Moving from ISC to DNSmasqd is pretty easy because you can for example move all Static DHCP IP Address Mappings between ISC/DNSmasqd/KEA via .CSV files which can be Exported/Imported.
- As long as you are not Delegating any IPv6 Prefix from OPNsense to another Router you don't need ISC or KEA and will probably be totally happy with DNSmasqd :)

PowerDNS is awesome. I worked for one of the biggest domain resellers and administered a few PowerDNS clusters...

However, this seems a bit of an overkill for my home network. Haha.

+1 on that last line :)

I also worked with powerdns clusters before, synchronized over mariadb for ISP purposes. So I knew that tool is great, also it's NL based which is a win for europe in general.

Good old XS4ALL now called Freedom Internet did well indeed :)