Tutoriel Linux

DHCP server under Linux: what to lock down before putting it into production

Débutant4 min de lecture
À retenirLinux n'est pas réservé aux experts. Le bon point de départ : une distribution accessible, une sauvegarde propre et quelques commandes comprises.

A poorly placed DHCP server on a network can quickly lead to problems: computers may receive an incorrect gateway, an address that’s already in use, or an incorrect DNS server. Before installing anything, be sure to check the following: who already distributes the addresses and on which interface your server should listen.

Illustration of a Linux administrator connecting a DHCP server to multiple network devices
Configure DHCP on the correct interface before distributing addresses.

Start by looking at the network, not by launching the service.

A DHCP server responds to requests broadcast on its network segment. Therefore, it should never be added next to the modem, router, or firewall that already provides DHCP leases, unless you have intentionally disabled this service on the existing equipment.

On the server, note the interfaces and the addressing scheme:

ip -br link
ip -4 addr
ip route
sudo ss -lunp | grep ':67'

The last command allows you to identify a process already listening on UDP port 67. Also verify that the target interface is indeed the LAN interface, not the administration link, a VPN tunnel, or the external interface. If you are working remotely, keep your SSH session open: a network error could cut off your access to the server.

Next, define a range that does not overlap with static IP addresses, the gateway, printers, NAS devices, or Wi-Fi access points. For a network 192.168.50.0/24, a beach between 192.168.50.100 And 192.168.50.200 leaves some leeway.

Install Kea and choose the interface to listen to.

On Debian, Kea is a modern and maintained DHCP solution. Install the DHCPv4 server:

sudo apt update
sudo apt install kea-dhcp4-server

The main file is usually located in /etc/kea/kea-dhcp4.confBefore modifying it, keep a copy:

sudo cp /etc/kea/kea-dhcp4.conf /etc/kea/kea-dhcp4.conf.bak

The following configuration is a minimal example. Replace enp1s0, the subnet, gateway, and DNS settings according to your own values. Do not copy the MAC address from the example for a reservation.

{
  "Dhcp4": {
    "interfaces-config": {
    },
    "valid-lifetime": 3600,
    "renew-timer": 900,
    "rebind-timer": 1800,
    "subnet4": [
      {
        "subnet": "192.168.50.0/24",
        "option-data": [
          { "name": "routers", "data": "192.168.50.1" },
          { "name": "domain-name-servers", "data": "192.168.50.1, 1.1.1.1" }
        ],
        "reservations": [
          {
            "hw-address": "00:11:22:33:44:55",
            "ip-address": "192.168.50.20"
          }
        ]
      }
    ]
  }
}

The section interfaces-config This is the crucial point. With a poor interface, Kea can launch without providing any service to its intended customers. The documentation Kea DHCPv4 details the subnets, pools and available options.

Test the configuration before assigning a single address

Do not restart the service immediately after pasting the file. Kea can test its configuration:

sudo kea-dhcp4 -t /etc/kea/kea-dhcp4.conf

Correct any errors returned, then start the service and monitor its logs:

sudo systemctl restart kea-dhcp4-server
sudo systemctl status kea-dhcp4-server --no-pager
sudo journalctl -u kea-dhcp4-server -f

Depending on the version or distribution, the unit name may vary. If this unit does not exist, list the Kea services before improvising:

systemctl list-unit-files | grep -i kea

Then test with a single non-critical customerIt needs to obtain an address from the range, the correct gateway, and the intended DNS servers. On the client, check the received address and the default route with ip -4 addr And ip routeTo understand the interfaces and routes before this test, you can also reread our guide on nmcli under Linux and the one dedicated to the fixed IP address on Debian.

This avoids the most troublesome breakdowns.

  • Only one DHCP server per VLAN or segment : disable DHCP on the box or router if Kea takes over.
  • A documented beach : keep static addresses out of the pool, or use a DHCP reservation.
  • Reasonable leases One hour is a good starting point on a small network. Only reduce it if customers really change frequently.
  • Monitored logs : after a modification, keep journalctl open during testing. Our article on tail and log tracking This can help if you also need to read an application file.
  • Consistent network filtering DHCP uses UDP 67 on the server side and UDP 68 on the client side. Do not copy a firewall rule randomly; first check which ports are actually open. ss and netstat.

Once the first lease is validated, let the service run for a few hours before migrating all workstations. Reservations and the log will quickly tell you if an address overlaps or if an old DHCP server is still responding on the network. See the Debian man page for kea-dhcp4 is useful for checking boot options and file testing.

sudo apt update && sudo apt upgrade