This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
advanced-dhcpdns [2022/01/20 17:06] – [DHCP Client (WAN)] hogwild | advanced-dhcpdns [2023/06/10 01:32] – [DHCP Client (WAN)] -condense hogwild | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== DHCP/DNS ====== | + | ====== DHCP/DNS/TFTP ====== |
+ | |||
+ | The DHCP/ | ||
- | The Advanced / DHCP/DNS page allows you to configure advanced settings for the DHCP and DNS services for both LAN and WAN. Most of this functionality is provided by FreshTomato' | ||
===== DHCP Client (WAN) ===== | ===== DHCP Client (WAN) ===== | ||
Line 11: | Line 12: | ||
{{: | {{: | ||
- | **Enable DNSSEC support: ** DNSSEC is a way to secure | + | **Enable DNSSEC support: ** DNSSEC is a way to secure DNS by introducing authentication for DNS servers. This prevents DNS hacking and poisoning. If the authoritative DNS server |
- | **Use dnscrypt-proxy: | + | DNSSEC |
- | When dnscrypt-proxy is checked, other options | + | **Use dnscrypt-proxy: **DNSCrypt encrypts DNS resolution. When a DNSCrypt-enabled server |
- | Ephemeral Keys. When checked, | + | |
- | Manual Entry. If enabled, 3 more fields are displayed: Resolver Address; the IPpv4 or IPv6 address of the dnscrypt-enabled DNS server, for example 1.2.3.4; Provider Name: The name of the DNS provider, for instance FreshTomato, | + | \\ |
- | Resolver. This dropdown list currently contains about 200 DNS servers. Some support DNSSEC. Some do not log your queries. Some are filtered. To help you choose a dnscrypt DNS provider, you may import / | + | * Ephemeral Keys - If checked, a new key pair is generated for each DNS query. Use this with care. It is very cpu-intensive, \\ so it may slow DNS resolution. |
- | Priority. Leave this at no-resolv to prevent DNS leaks! | + | * Manual Entry - If enabled, 3 more fields are displayed: |
+ | * Resolver Address | ||
+ | * Provider Name - This is the name of the DNS provider, for instance FreshTomato. | ||
+ | * Provider Public Key - The public key provided by the DNSCRYPT-enabled DNS provider (to generate a key pair) | ||
- | Local Port. Specifies the port number on which the dnscrypt proxy communicates with FreshTomato' | + | * Resolver - This dropdown list currently contains about 200 DNS servers. |
+ | * Some support DNSSEC. | ||
+ | * Some don't log queries. | ||
+ | * Some are filtered. | ||
- | Log Level. This sets which level of messages are logged in syslog | + | * Priority - This should be left at // |
- | **Use Stubby (DNS-over-TLS):** This enhances | + | |
- | **WINS (for DHCP):** Here, you can specify | + | |
- | Windows Internet Name Service | + | **Use Stubby |
- | **dhcpc options:** In this field you can enter custom configuration settings for the dhcp client. | + | \\ |
+ | |||
+ | When Stubby is enabled, some further options appear: | ||
+ | |||
+ | {{: | ||
+ | |||
+ | \\ | ||
+ | |||
+ | **Upstream resolvers: | ||
+ | |||
+ | **Priority: | ||
+ | |||
+ | * Strict-Order - Stubby is tried first, but if it experiences issues, fallback to other methods of name resolution, such as standard DNS. | ||
+ | * No-Resolv - If Stubby fails or has issues, there will be no fallback to other DNS resolution methods anywhere. | ||
+ | * None - This adds stubby as a resolution method for dnsmasq. This alone does not guarantee. | ||
+ | |||
+ | \\ | ||
+ | |||
+ | **Local Port:** This is the port number on which Stubby serves clients. Dnsmasq will be the only client for Stubby, \\ but it is dnsmasq that serves clients. | ||
+ | |||
+ | **Log Level:** Here, you can choose what level of details is written in log entries. | ||
+ | |||
+ | **Force TLS1.3: | ||
+ | |||
+ | **WINS (for DHCP):** Here you specify the IP address of a WINS Server that will be given to DHCP clients. This does NOT actually enable the WINS service. FreshTomato' | ||
+ | |||
+ | Windows Internet Name Service (WINS) is a legacy name resolution service that maps NetBIOS names to IP addresses. Officially, it's outdated and largely obsolete. DNS was supposed to replace WINS functionality. However, Microsoft has not officially deprecated WINS. WINS may still be necessary for some Windows LAN browsing functions on old Windows versions. | ||
+ | |||
+ | **DHCPC Options:** In this field you can enter custom configuration settings for the dhcp client. | ||
+ | |||
+ | **Reduce Packet Size:** //udhcpc// (the DHCP client FreshTomato uses to obtain a WAN IP address) has a problem. It has a DHCP discovery packet size 590 bytes long. However, DHCP relay servers can only handle DHCP discovery packets up to 576 bytes. If there are DHCP relay servers between your FreshTomato router and your Internet provider' | ||
- | **Reduce Packet Size:** //udhcpc// (the DHCP client FreshTomato uses to obtain a WAN IP address) has a problem. It has a DHCP discovery packet size 590 bytes long. However, DHCP relay servers can only handle DHCP discovery packets up to 576 bytes. If there are DHCP relay servers between your FreshTomato router and your Internet provider' | + | The extra bytes appeared to be entirely padding, and therefore unnecessary. FreshTomato developers eliminated the padding, |
===== DHCP / DNS Server (LAN) ===== | ===== DHCP / DNS Server (LAN) ===== | ||
+ | |||
+ | \\ | ||
{{: | {{: | ||
- | **Use internal DNS: | + | **Use internal DNS: |
**Debug mode:** Checking this makes FreshTomato write detailed information to the log file. | **Debug mode:** Checking this makes FreshTomato write detailed information to the log file. | ||
- | **Use received DNS with user-entered DNS: **Add DNS servers received from DHCP on your WAN connection to the static (manual) DNS server list. See Basic/Network for more information. (Default: Disabled). | + | **Use received DNS with user-entered DNS: **Add DNS servers received from DHCP on your WAN connection to the manual DNS server list. Please |
- | **Intercept DNS port: | + | **Intercept DNS port: |
- | **Use user-entered gateway if WAN is disabled**: | + | **Use user-entered gateway if WAN is disabled**: |
- | **Ignore DHCP requests from unknown devices**: dnsmasq | + | **Ignore DHCP requests from unknown devices**: |
- | **Generate a name for DHCP clients which do not otherwise have one**: If the hostname in the device list is not reported, this will generate | + | **Generate a name for DHCP clients which do not otherwise have one**: If a hostname in the device list is not reported, this will automatically |
\\ | \\ | ||
Line 64: | Line 103: | ||
\\ | \\ | ||
- | **Solve .onion using Tor** (Enable Tor first): As the option | + | **Solve .onion using Tor** This option |
- | **Maximum active DHCP leases:** Maximum allowed active DHCP leases at one time. (Default: 255). | + | FreshTomato has a built-in Tor client. For more information about this, see the TOR |
- | **Static lease time:** The absolute | + | **Maximum active DHCP leases:** Sets the maximum |
- | | + | **Static lease time:** Sets the absolute maximum valid time for any DHCP lease. |
- | * Infinite\\ The Static lease time is infinity | + | |
- | * Custom\\ This allows you to enter a custom Static | + | |
- | **Announce IPv6 on LAN (SLAAC): **Enabling this turns on router advertisements for IPv6 //Stateless Address Autoconfiguration | + | |
+ | * Infinite\\ Static lease time is infinity | ||
+ | * Custom\\ | ||
- | **Announce IPv6 on LAN (DHCP): | + | To retain leases after rebooting the router, please see this [[retain_dhcp_lease_info_after_a_reboot|HOWTO]] for additional information on non-volatile dhcp leases. |
+ | |||
+ | **Announce IPv6 on LAN (SLAAC): **Enabling this turns on router advertisements for IPv6 //Stateless Address Autoconfiguration (SLAAC)// | ||
+ | |||
+ | - The client sends out an RS (router solicitation) ICMP packet. | ||
+ | - The nearest router responds with an RA (router advertisement) packet. | ||
+ | - The client uses the IPv6 prefix from the RA packet as the first 64 bits of its address. It then derives the last 64 bits of its address using the EUI-64 process or a randomization algorithm. | ||
+ | |||
+ | **Announce IPv6 on LAN (DHCP): | ||
**Fast RA mode**: Forces dnsmasq to be always in frequent RA mode. | **Fast RA mode**: Forces dnsmasq to be always in frequent RA mode. | ||
Line 86: | Line 133: | ||
**Mute dhcpv6 logging: **Enabling this stops FreshTomato from logging IPv6 dhcp activity. (Default: Disabled). | **Mute dhcpv6 logging: **Enabling this stops FreshTomato from logging IPv6 dhcp activity. (Default: Disabled). | ||
- | **Mute RA logging: | + | **Mute RA logging: |
\\ | \\ | ||
Line 92: | Line 139: | ||
{{: | {{: | ||
- | **Prevent client auto DoH**: Modern browsers such as Firefox have a built-in function called DNS Over HTTP(s). When DoH is enabled, a browser can completely | + | **Prevent client auto DoH**: Modern browsers such as Firefox have a built-in function called DNS Over HTTP(s). When DoH is enabled, a browser can bypass the system's DNS server. Enabling the Prevent client auto DOH option prevents DoH communication. This is helpful for getting FreshTomato' |
- | **Enable DNS Rebind protection**: | + | **Enable DNS Rebind protection**: |
- | **Forward local domain queries to the upstream DNS**: Enabling this forwards local domains to the router' | + | **Forward local domain queries to the upstream DNS**: Enabling this forwards local domains to the router' |
- | **Enable multicast DNS** (Avahi mDNS): FIXME | + | **Enable multicast DNS:** Checking this enables an implementation of Avahi mDNS. Avahi is system that enables programs to publish and discover services and hosts running on a LAN. It is a zero-configuration implementation which includes multicast service discovery via the mDNS/DNS-SD protocol suite. " |
**Enable reflector** FIXME | **Enable reflector** FIXME | ||
- | **Custom configuration: | + | **Custom configuration: |
+ | |||
+ | |||
+ | ===== TFTP Server ===== | ||
+ | |||
+ | **Enable TFTP**: Enabling this starts dnsmasq' | ||
+ | |||
+ | **TFTP root path**: Text entered here defines where TFTP root is located in the filesystem. | ||
+ | |||
+ | **PXE on LANx (brx)**: Enbables PXE (Pre Boot eXecution Environment) on one or more bridges. PXE was designed for diskless clients. A PXE client can obtain an IP address via DHCP and, once obtained, download boot code via a TFTP location. Syslinux is a good example of these principles/ | ||
===== DHCP / DNS Notes ===== | ===== DHCP / DNS Notes ===== | ||
- | * Do not use results from: [[https:// | + | * Do not use results from Cloudflare' |
- | * | + | * DNSSEC |