Wrong domain name w/Unbound DHCP leases with multiple VLANs

[Patrick M. Hausen]

It can technically be done with ISC DHCP and BIND but the OPNsense framework and UI doesn't support it, if I am not mistaken.

Possibly there are hooks in place for custom configuration that will survive reboots and updates.

[ctrlbrk]

Also looked at dnsmasq in OPN and found this language (this time I RTFM)

The domain name to use for DHCP hostname registration. If empty, the default system domain is used. Note that all DHCP leases will be assigned to the same domain. If this is undesired, static DHCP lease registration is able to provide coherent mappings.

So I guess dnsmasq also out.

[Fright]

@pmhausen
GUI contains ddns parameters (click Advanced button on Dynamic DNS parameter) that generates plausible directives in .conf. I use internal dhcp-s, so I did not check it

[franco]

Well, Dnsmasq used the same tool as Unbound a while back so it's not unnatural for it to have the same limitation anyway.

https://github.com/opnsense/core/issues/5119


Cheers,
Franco

[Patrick M. Hausen]

GUI contains ddns parameters (click Advanced button on Dynamic DNS parameter) that generates plausible directives in .conf. I use internal dhcp-s, so I did not check it

Good to know, thanks. So it's only the BIND plugin that lacks a bit in options, here. Improvements always welcome. 

[Fright]

So it's only the BIND plugin that lacks a bit in options, here. Improvements always welcome.
at first (!) glance everything is not so scary with unbound:
small changes in dhcpd.inc generates 'dhcp pool'->'domain-name' file that i can try to use in unbound_dhcpd.py to change 'domain' to one from pool settings ("lease ip -> pool -> pool domain" if any).
but I have no way to test this on real clients.
maybe there are utilities emulating clients with a complete process of obtaining a lease? (nmap only sends a DHCPINFORM afaik)

[Patrick M. Hausen]

My point is that dhcpd and named actually share a common standard protocol for dynamic updates so nobody would need to code "lease update magic" at the file level. Dhcpd can send named all the info whenever a lease is issued or renewed.

[franco]

Bind was removed from BSDs and replaced with Unbound for security reasons. Now we want to bring Bind in to fill a small gap because it already has this implemented? Sounds like going in circles.


Cheers,
Franco

[Patrick M. Hausen]

I'd say it was removed because it was not considered worth to keep up with upstream patches for just a local cacheing recursive NS. But it's still in ports and well supported.

I'll look into the BIND plugin, possibly this can be added as an option.

[franco]

Fair enough, it would help those who can/want to run a Bind server locally quickly.


Thanks,
Franco

[ctrlbrk]

From GitHub, it looks like this has been solved? How can I test the new version?

[franco]

I can post test instructions tomorrow after giving it a try.


Cheers,
Franco

[dlevasseur]

From GitHub, it looks like this has been solved? How can I test the new version?

I may have gotten lost in the conversation of the original problem and the talk of DDNS.  Are you saying Unbound handling multiple domain names on different VLANs has been fixed?

I'm fully updated and have the same issue as the OP.  Wondering if there is a solution coming or not.  It's not a huge deal, just easier to understand what device I'm looking at on a rDNS lookup (pi-hole stats).

[franco]

It's in the development version but wasn't cleared for release just yet. It might be in 21.7.3 next week given that it works fine.

So far, however, lots of "want want want" but no feedback on the actual implementation.

This is business as usual but makes us question if it was really that important.


Cheers,
Franco

[dlevasseur]

Again, forgive me as I'm not a developer and such...

Thanks for the update on that.  I'm not sure what you would like for implementation feedback, just testers or what settings should be placed in the UI? 

I wouldn't say it is necessarily "important"? but I don't believe it is expected behavior to query unbound and have it come back with a default domain when a machine is on a different vlan with different domain.  That's how I wandered into this thread.  More than likely users just don't care or don't do rDNS lookups often?  No idea.

Really appreciate the work on OPN, I've been pretty happy with it overall.  This isn't a sticking point where I would go through the work of switching or putting my USG (shudder) back in place.