DHCPv4/Server

Allgemein

• DHCP (Dynamic Host Configuration Protocol)
• Transport durch UDP
• Standard-Ports:
  • IPv4: 67 (Server) 68 (Client)
  • IPv6: 547 (Server) 546 (Client)

Aufgabe

• Clients automatisch in ein bestehendes Netz einbinden
• Übermittlung der Netzwerkeinstellungen:
  • IP-Adressen
  • Rechnername
  • Netzmaske
  • Broadcast-Adresse
  • Gateway
  • DNS-Nameserver
  • NetBIOS Nameserver
  • Boot-Image für plattenlose Workstations
  • Time- und NTP-Server, die für die Synchronisierung der Uhrzeit zuständig sind

Betriebsmodi

• Dynamische Zuordnung:
  • Automatische Zuordnung mit Lease-Time: Festlegung wie lange eine IP-Adresse an Client „verliehen“ wird, bevor Client eine „Verlängerung“ beantragen muss
  • Bei „Nicht-Verlängerung“ wird IP-Adresse frei und neu vergeben
• Automatische Zuordnung:
  • Am DHCP-Server wird ein Bereich (range) von IP-Adressen definiert.
  • IP-Adressen werden automatisch an die MAC-Adressen von neuen DHCP-Clients zugewiesen und keinem anderen Host mehr zugewiesen
  • Zuweisungen sind permanent (siehe /var/lib/dhcpd.leases)
  • Neue Clients erhalten keine IP-Adresse, wenn Adressbereich vergeben, auch wenn IP-Adressen nicht aktiv genutzt werden
• Statische Zuordnung:
  • IP-Adressen werden MAC-Adressen fest zugeordnet; wichtig bei Port-Weiterleitungen oder wenn DHCP-Client Server-Dienste zur Verfügung stellt
  • Kein „einfaches“ Einbinden von neuen Clients

Ablauf

1. DHCP-DISCOVER: Client sucht per Broadcast nach DHCP-Server
2. DHCP-OFFER: DHCP-Server bietet Client per Unicast Konfigurationsparameter der Schnittstelle an
3. DHCP-REQUEST: Client fordert angebotene Konfigurationsparameter bei DHCP-Server an (z.B. Mietanfrage)
4. DHCP-ACK: DHCP-Server sendet Konfigurationsparameter an Client

DHCP Ablauf

• DHCP-NAK: Ablehnung einer DHCPREQUEST-Anforderung durch den DHCP-Server.
• DHCP-DECLINE: Ablehnung durch den Client, da die IP-Adresse schon verwendet wird.
• DHCP-RELEASE: Der Client gibt die eigene Konfiguration frei, damit die Parameter wieder für andere Clients zur Verfügung stehen.
• DHCP-INFORM: Anfrage eines Clients nach weiteren Konfigurationsparametern, z. B. weil der Client eine statische IP-Adresse besitzt.

DHCP-Refresh (nur bei dynamischer Zuordnung)

DHCPACK-Nachricht IP-Adresse,"lease time" und zwei Fristen: Die "Renewal-Time" T1 und die "Rebinding-Time" T2.

• T1 1/2 der Lease-Time
• T2 7/8 der Lease-Time

Zum Beispiel:

• Lease-Time = 100s => "Renewal-Time" T1 = 50s und "Rebinding-Time" T2 = 87,5s
• Nach Ablauf T1 versucht der Client, seine Lease-Time zu verlängern.
• DHCPREQUESTs per Unicast an bisherigen Server
  • Erfolgt DHCP-ACK: Client erhält bisherige Konfiguration mit frischer Lease-Time
  • Erfolgt kein DHCP-ACK: Client nutzt Konfiguration ohne Einschränkungen weiter
• Nach Ablauf von T2 sendet Client DHCPREQUESTs per Broadcast an irgendeinen anderen DHCP-Server
• Läuft die Lease-Time ab so verfällt die Konfiguration und Client beginnt erneut mit eunem DHCP-DISCOVER.
• Sind alle IP-Adressen bereits vergeben, sendet Server ein DHCP-NAK (DHCP-Not Acknowledged).

Einrichtung unter Linux/Debian

Installation

root@router:~# apt install isc-dhcp-server

Konfiguration

/etc/dhcp/dhcpd.conf

• Lease-Time in Sekunden

default-lease-time 600;
max-lease-time 7200;

• Subnet-Blöcke

subnet 10.30.30.0 netmask 255.255.255.0

• Range

range 10.30.30.10 10.30.30.99;

• Options

option subnet-mask 255.255.255.0;
       option domain-name-servers 10.0.0.3, 10.0.0.4;
       option domain-name "raum102.itw";
       option domain-search "raum102.itw";
       option routers 10.30.30.1;
       option broadcast-address 10.30.30.255;

• Nach der Änderung der Konfiguration, muss die dhcpd.conf erneut eingelesen werden.

root@router0230:~# systemctl restart isc-dhcp-server.service

• Damit Änderungen bei bereits aktivem Client wirksam werden, muss dieser sie neu anfordern.
• Bisherige Konfiguration verwerfen.

root@router0230:~# dhclient -r

• Neue Konfiguration anfordern.

root@router0230:~# dhclient

Fehlerauslesung

/var/log/syslog

root@router:~# cat /var/log/syslog | grep "dhcp"

Erst Ordner /var/lib/dhcpd erzeugen.

root@router:~# touch /var/lib/dhcpd

Dann Datei dhcpd.leases.

root@router:~# touch /var/lib/dhcpd/dhcpd.leases

Danach wird diese Datei erst beschrieben und kann ausgelesen werden.

root@router:~# cat /var/lib/dhcpd/dhcpd.leases

Konfigurationsdatei auf Server

/etc/dhcp/dhcpd.conf

dhcpd.conf
#
# Sample configuration file for ISC dhcpd
#

# option definitions common to all supported networks...
#option domain-name "example.org";
#option domain-name-servers ns1.example.org, ns2.example.org;

#default-lease-time 600;
#max-lease-time 7200;

# The ddns-updates-style parameter controls whether or not the server will
# attempt to do a DNS update when a lease is confirmed. We default to the
# behavior of the version 2 packages ('none', since DHCP v2 didn't
# have support for DDNS.)
#ddns-update-style none;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;
 
#No service will be given on this subnet, but declaring it helps the 
# DHCP server to understand the network topology.

#subnet 10.152.187.0 netmask 255.255.255.0 {
#}

# This is a very basic subnet declaration.

#subnet 10.254.239.0 netmask 255.255.255.224 {
#  range 10.254.239.10 10.254.239.20;
#  option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
#}

# This declaration allows BOOTP clients to get dynamic addresses,
# which we don't really recommend.

#subnet 10.254.239.32 netmask 255.255.255.224 {
#  range dynamic-bootp 10.254.239.40 10.254.239.60;
#  option broadcast-address 10.254.239.31;
#  option routers rtr-239-32-1.example.org;
#}

# A slightly different configuration for an internal subnet.
subnet 10.30.30.0 netmask 255.255.255.0 {
       range 10.30.30.10 10.30.30.99;
       option subnet-mask 255.255.255.0;
       option domain-name-servers 10.0.0.3, 10.0.0.4;
       option domain-name "raum102.itw";
       option domain-search "raum102.itw";
       option routers 10.30.30.1;
       option broadcast-address 10.30.30.255;
       default-lease-time 600;
       max-lease-time 7200;
host user {
  hardware ethernet 00:1d:7d:c8:de:bd;
  fixed-address 10.30.30.5;
  option host-name "user";
}
host robert {
  hardware ethernet 74:27:ea:e1:b2:b4;
  fixed-address 10.30.30.6;
  option host-name "robert";
}
host meik {
  hardware ethernet 74:27:ea:cc:fe:a0;
  fixed-address 10.30.30.7;
  option host-name "meik";
}
host ufuk {
  hardware ethernet 74:27:ea:e1:ba:b1;
  fixed-address 10.30.30.8;
  option host-name "ufuk";
}
host tanja {
  hardware ethernet 74:27:ea:e1:b1:e4;
  fixed-address 10.30.30.9;
  option host-name "tanja";
}
}
# Hosts which require special configuration options can be listed in
# host statements.   If no address is specified, the address will be
# allocated dynamically (if possible), but the host-specific information
# will still come from the host declaration.
#host passacaglia {
#  hardware ethernet 0:0:c0:5d:bd:95;
#  filename "vmunix.passacaglia";
#  server-name "toccata.example.com";
#}

# Fixed IP addresses can also be specified for hosts.   These addresses
# should not also be listed as being available for dynamic assignment.
# Hosts for which fixed IP addresses have been specified can boot using
# BOOTP or DHCP.   Hosts for which no fixed address is specified can only
# be booted with DHCP, unless there is an address range on the subnet
# to which a BOOTP client is connected which has the dynamic-bootp flag
# set.
#host fantasia {
#  hardware ethernet 08:00:07:26:c0:a5;
#  fixed-address fantasia.example.com;
#}

# You can declare a class of clients and then do address allocation
# based on that.   The example below shows a case where all clients
# in a certain class get addresses on the 10.17.224/24 subnet, and all
# other clients get addresses on the 10.0.29/24 subnet.

#class "foo" {
#  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
#}

#shared-network 224-29 {
#  subnet 10.17.224.0 netmask 255.255.255.0 {
#    option routers rtr-224.example.org;
#  }
#  subnet 10.0.29.0 netmask 255.255.255.0 {
#    option routers rtr-29.example.org;
#  }
#  pool {
#    allow members of "foo";
#    range 10.17.224.10 10.17.224.250;
#  }
#  pool {
#    deny members of "foo";
#    range 10.0.29.10 10.0.29.230;
#  }
#}

Konfigurationsdatei auf Client

/etc/dhcp/dhclient.conf

# Configuration file for /sbin/dhclient.
#
# This is a sample configuration file for dhclient. See dhclient.conf's 
#       man page for more information about the syntax of this file 
#       and a more comprehensive list of the parameters understood by 
#       dhclient.
#
# Normally, if the DHCP server provides reasonable information and does
#       not leave anything out (like the domain name, for example), then
#       few changes must be made to this file, if any.
#

option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;

send host-name = gethostname();
request subnet-mask, broadcast-address, time-offset, routers,
        domain-name, domain-name-servers, domain-search, host-name,
        dhcp6.name-servers, dhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers,
        netbios-name-servers, netbios-scope, interface-mtu,
        rfc3442-classless-static-routes, ntp-servers;

#send dhcp-client-identifier 1:0:a0:24:ab:fb:9c;
#send dhcp-lease-time 3600;
#supersede domain-name "fugue.com home.vix.com";
#prepend domain-name-servers 127.0.0.1;
#require subnet-mask, domain-name-servers;
#timeout 60;
#retry 60;
#reboot 10;
#select-timeout 5;
#initial-interval 2;
#script "/sbin/dhclient-script";
#media "-link0 -link1 -link2", "link0 link1";
#reject 192.33.137.209;

#alias {
#  interface "eth0";
#  fixed-address 192.5.5.213;
#  option subnet-mask 255.255.255.255;
#}

#lease {
#  interface "eth0";
#  fixed-address 192.33.137.200;
#  medium "link0 link1";
#  option host-name "andare.swiftmedia.com";
#  option subnet-mask 255.255.255.0;
#  option broadcast-address 192.33.137.255;
#  option routers 192.33.137.250;
#  option domain-name-servers 127.0.0.1;
#  renew 2 2000/1/12 00:00:01;
#  rebind 2 2000/1/12 00:00:01;
#  expire 2 2000/1/12 00:00:01;
#}

Quellen

wikipedia.org isc.org ubuntuusers.de wiki.debian.org