[SOLVED] Kea DHCP vs Dnsmasq:what real advantages for a multi-VLAN home lab?

[(MARLOO)]

Hi,

I am currently using Dnsmasq for DHCP and DNS on my OPNsense home lab, with a LAN and several VLANs. Everything is working fine.

I am evaluating whether Kea DHCP would give me any real advantage for my setup. I only want to understand the concrete benefits of Kea compared with Dnsmasq DHCPv4.

An important difference is DNS integration. Dnsmasq is a combined DNS, DHCP and Router Advertisement service: it can resolve and cache DNS queries, provide Router Advertisements, and dynamically register DHCP client hostnames in Unbound.

Kea is DHCP-only. It can advertise DNS servers to clients through DHCP options, but it does not provide a DNS resolver/cache, Router Advertisements, or dynamic hostname registration in Unbound. With Kea, Unbound and radvd are still required for a full DNS/DHCP/RA setup.

Kea does have a DDNS Agent, but it only sends RFC2136 updates to an authoritative DNS server such as BIND or PowerDNS. Recursive DNS servers such as Dnsmasq or Unbound cannot be used as the target for those updates.

For a home lab with a few VLANs, fewer than 1000 clients, no HA pair, no RFC2136 DDNS and no complex PXE/IPv6 requirements, I see no practical advantage in switching from Dnsmasq to Kea.

The only concrete advantages I can identify are:

1. Deleting individual leases from the GUI through the Control Agent.
2. API-based DHCP management/automation.
3. HA with lease synchronization, if I later deploy a second OPNsense firewall.
4. More advanced DHCPv6 Prefix Delegation and conditional DHCP options.

I also saw a recent thread where static Dnsmasq reservations did not seem to work for some devices, possibly because of DUID-based client identification or an old dynamic lease that was never released. However, that is not the main reason for my question.

So, my question is: does Kea offer any real advantage for a multi-VLAN home lab compared with Dnsmasq DHCPv4, especially considering that Kea does not provide DNS, Router Advertisements or dynamic hostname registration in Unbound?

Thanks.

[Patrick M. Hausen]

No.

[nero355]

I am evaluating whether Kea DHCP would give me any real advantage for my setup.

I would say you have perfectly done your homework and there is not much/nothing to add to what you know so far :)

[(MARLOO)]

Thanks both for  confirming.

That was exactly the conclusion I was leaning towards: for a single-firewall, multi-VLAN home lab without HA, RFC 2136 DDNS or advanced DHCPv6 requirements, Dnsmasq's integrated DNS/DHCP/RA behaviour is more practical than gaining Kea's API and HA features.

I'll stay with Dnsmasq and revisit Kea only if I later deploy a second OPNsense firewall or need API-driven DHCP automation.

[Patrick M. Hausen]

I use Kea and Unbound because it's simpler. I don't want dynamic DHCP clients polluting my carefully maintained DNS zone. Why would I want "Paddys-Macbook-Pro" in my DNS? DNS entries are for servers that need to be reachable by clients, have certificates, etc.

My approach. Yours is different.

[(MARLOO)]

@Patrick M. Hausen

I understand your point: in a carefully maintained DNS zone, dynamic client names would be unwanted noise.

In my home lab, however, dynamic registration is a deliberate convenience. It lets me reach laptops, VMs, phones and IoT devices by name without maintaining a static DNS entry for every temporary client.

Being able to resolve client hostnames is also useful for SSH, SMB, printing, Home Assistant integrations, remote access, and quickly reaching a VM or laptop without looking up its current IP.

For servers, infrastructure and services that need stable names or certificates, I agree that explicit static DNS records are the right approach. So it is not really Dnsmasq versus Kea: it is whether you want automatic client-name registration or a clean, manually managed DNS zone.

I will stay with Dnsmasq, but use static records for the important services and infrastructure.

Both approaches are valid; yours is probably the better fit for a production-like DNS environment, while mine is the better fit for a frequently changing home lab.

[nero355]

I don't want dynamic DHCP clients polluting my carefully maintained DNS zone.

Why would I want "Paddys-Macbook-Pro" in my DNS?

Because in your case you run AdGuard and want to see all Clients listed there and what they are up to ?!

I do the same with Pi-Hole and check for weird traffic from time to time :)

It's also easier when you need to Whitelist some domain for someone : Click on the Client's Hostname and start troubleshooting!

It lets me reach laptops, VMs, phones and IoT devices by name without maintaining a static DNS entry for every temporary client.

I actually do maintain Local DNS Records in Pi-Hole that match Static DHCP Mappings based on the MAC Address in KEA in OPNsense.

Being able to resolve client hostnames is also useful for SSH, SMB, printing, Home Assistant integrations, remote access, and quickly reaching a VM or laptop without looking up its current IP.

My favorite is reaching the Printer's webGUI to check errors and statistics :)

Both approaches are valid.

Ofcourse!


IMHO your first post could be easily added to the OPNsense Documentation or perhaps you could put it online somewhere like GitHUB ?
It would be easy to point people to when they ask what to use or maybe still need to migrate from ISC to one of them!

[Patrick M. Hausen]

My printer has a static address, a DNS entry, and is managed via SNMP. 🙂

[(MARLOO)]

IMHO your first post could be easily added to the OPNsense Documentation or perhaps you could put it online somewhere like GitHUB ?
It would be easy to point people to when they ask what to use or maybe still need to migrate from ISC to one of them!

Thanks for the suggestion. I have created a post and added it to the FAQs.

It is only intended as a concise summary of the main practical differences between Dnsmasq and Kea, not as a complete guide. I hope it can be useful as a quick reference.


https://forum.opnsense.org/index.php?topic=53150.0

[passeri]

That was exactly the conclusion I was leaning towards

Yes, you argued it in your opening post. For this reason I disagree with @nero355 that your post might be useful as implicitly standalone advice in Opnsense documentation. As one of the options, of course it lays out a valid position. However, one does not need to be in a production environment or launch a thousand devices to find Kea / Unbound an optimal solution for home needs. Patrick put the basics of that clearly.

It depends on the user, not the system.

[(MARLOO)]

That was exactly the conclusion I was leaning towards

Yes, you argued it in your opening post. For this reason I disagree with @nero355 that your post might be useful as implicitly standalone advice in Opnsense documentation. As one of the options, of course it lays out a valid position. However, one does not need to be in a production environment or launch a thousand devices to find Kea / Unbound an optimal solution for home needs. Patrick put the basics of that clearly.

It depends on the user, not the system.

You are right about the general point, and I agree.

My post reflects my own use case and preferences, not a general recommendation. Dnsmasq is convenient for me because I want DHCP client hostnames to be automatically resolvable through Unbound, along with integrated Router Advertisements.

@nero355 did suggest that the post could be added to the documentation or published elsewhere as a reference. However, I agree that it should not be presented as standalone advice: the best choice depends on the user's preferred DNS/DHCP workflow.

Kea plus Unbound can absolutely be an excellent solution for a home network as well, especially for users who prefer a clean, manually maintained DNS zone without dynamic client names.

I have clarified this in the FAQ to avoid giving the impression that Dnsmasq is automatically the better choice for home use.

[Netlearn]

Thanks @(MARLOO) for your post explaining the main points on how to choose from dnsmasq and KEA.

I wish I could have read an explanation so concise and clear years ago. I think it will be very useful to others.