This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
advanced-dhcpdns [2022/02/16 18:38] – [DHCP Client (WAN)]-condense, formatting hogwild | advanced-dhcpdns [2023/05/29 04:01] – [TFTP Server] -resize screenshot: "pasted:20230425-142248.png" to 744x148 hogwild | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== DHCP/DNS ====== | + | ====== DHCP/DNS/TFTP ====== |
+ | |||
+ | The DHCP/ | ||
- | The Advanced / DHCP/DNS page allows you to configure advanced settings for the DHCP and DNS services for both LAN and WAN. Most of this functionality is provided by FreshTomato' | ||
===== DHCP Client (WAN) ===== | ===== DHCP Client (WAN) ===== | ||
Line 11: | Line 12: | ||
{{: | {{: | ||
- | **Enable DNSSEC support: ** DNSSEC is a way to secure DNS by introducing authentication for DNS servers. This prevents DNS hacking and poisoning. | + | **Enable DNSSEC support: ** DNSSEC is a way to secure DNS by introducing authentication for DNS servers. This prevents DNS hacking and poisoning. |
- | **Use dnscrypt-proxy: | + | **Use dnscrypt-proxy: |
- | When dnscrypt-proxy is checked, the following options/ | + | |
+ | |||
+ | \\ | ||
+ | |||
+ | * Ephemeral Keys - If checked, a new key pair is generated for each DNS query. Use this with care. It is very cpu-intensive, | ||
- | * Ephemeral Keys - If checked, a new key pair is generated for each DNS query. Use with care, this is very cpu-intensive. It may slow DNS resolution. \\ | ||
* Manual Entry - If enabled, 3 more fields are displayed: | * Manual Entry - If enabled, 3 more fields are displayed: | ||
- | * Resolver Address; the IP address of the dnscrypt-enabled DNS server, for example 1.2.3.4; | + | * Resolver Address |
- | * Provider Name: The name of the DNS provider, for instance FreshTomato; | + | * Provider Name - This is the name of the DNS provider, for instance FreshTomato. |
- | * Provider Public Key: a public key provided by the DNSCRYPT-enabled DNS provider | + | * Provider Public Key - The public key provided by the DNSCRYPT-enabled DNS provider |
- | * Resolver - This dropdown list currently contains about 200 DNS servers. Some support DNSSEC. Some don't log queries. Some are filtered. To help you choose a DNSCrypt DNS provider, import the file / | + | |
- | * Priority - Leave this at // | + | |
- | * Local Port - Specifies the port on which dnscrypt-proxy communicates with FreshTomato' | + | |
- | * Log Level - This sets the level of messages logged in syslog (when activated). | + | |
- | **Use Stubby (DNS-over-TLS): | + | |
+ | * Some support DNSSEC. | ||
+ | * Some don't log queries. | ||
+ | * Some are filtered. | ||
- | **WINS (for DHCP):** Here, you can specify the IP address of a WINS Server which will be given to DHCP clients. This does NOT actually enable the WINS service. FreshTomato' | + | |
- | Windows Internet Name Service (WINS) is a legacy name registration and resolution service | + | * Local Port - Specifies the port on which dnscrypt-proxy communicates with FreshTomato DNS. Leave this at 40 unless you're a highly advanced user. Do NOT set it to 53, as this may create a loop. |
- | **dhcpc options: | + | \\ |
- | **Reduce Packet Size:** //udhcpc// (the DHCP client FreshTomato uses to obtain a WAN IP address) has a problem. It has a DHCP discovery packet size 590 bytes long. However, DHCP relay servers can only handle DHCP discovery packets up to 576 bytes. If there are DHCP relay servers between your FreshTomato router and your Internet provider' | + | **Use Stubby (DNS-over-TLS): |
+ | |||
+ | \\ | ||
+ | |||
+ | When Stubby is enabled, some further options appear: | ||
+ | |||
+ | {{: | ||
+ | |||
+ | \\ | ||
+ | |||
+ | **Upstream resolvers: | ||
+ | |||
+ | **Priority: | ||
+ | |||
+ | * Strict-Order: | ||
+ | * No-Resolv: | ||
+ | * None: This adds stubby as a resolution method for the built-in dnsmasq. This alone does not guarantee. | ||
+ | |||
+ | **Local Port:** The port number on which Stubby will serve clients. Note that dnsmasq will be the only client for Stubby, but it is dnsmasq that serves clients. | ||
+ | |||
+ | **Log Level:** Allows you to choose what level of details is written in log entries. | ||
+ | |||
+ | **Force TLS1.3: | ||
+ | |||
+ | **WINS (for DHCP):** Here you specify the IP address of a WINS Server that will be given to DHCP clients. This does NOT actually enable the WINS service. FreshTomato' | ||
+ | |||
+ | Windows Internet Name Service (WINS) is a legacy name registration and resolution service that maps computer NetBIOS names to IP addresses. Officially, WINS is outdated and largely obsolete. DNS was supposed to have replaced WINS functionality. However, Microsoft has not officially deprecated WINS. WINS may still be necessary for some Windows LAN browsing functions, especially on old Windows versions. | ||
+ | |||
+ | **DHCPC Options: | ||
+ | |||
+ | **Reduce Packet Size:** //udhcpc// (the DHCP client FreshTomato uses to obtain a WAN IP address) has a problem. It has a DHCP discovery packet size 590 bytes long. However, DHCP relay servers can only handle DHCP discovery packets up to 576 bytes. If there are DHCP relay servers between your FreshTomato router and your Internet provider' | ||
===== DHCP / DNS Server (LAN) ===== | ===== DHCP / DNS Server (LAN) ===== | ||
+ | |||
+ | \\ | ||
{{: | {{: | ||
Line 46: | Line 81: | ||
**Debug mode:** Checking this makes FreshTomato write detailed information to the log file. | **Debug mode:** Checking this makes FreshTomato write detailed information to the log file. | ||
- | **Use received DNS with user-entered DNS: **Add DNS servers received from DHCP on your WAN connection to the manual DNS server list. See Basic/Network for more information. (Default: Disabled). | + | **Use received DNS with user-entered DNS: **Add DNS servers received from DHCP on your WAN connection to the manual DNS server list. Please |
- | **Intercept DNS port: | + | **Intercept DNS port: |
- | **Use user-entered gateway if WAN is disabled**: | + | **Use user-entered gateway if WAN is disabled**: |
- | **Ignore DHCP requests from unknown devices**: dnsmasq | + | **Ignore DHCP requests from unknown devices**: |
- | **Generate a name for DHCP clients which do not otherwise have one**: If the hostname in the device list is not reported, this will generate | + | **Generate a name for DHCP clients which do not otherwise have one**: If a hostname in the device list is not reported, this will automatically |
\\ | \\ | ||
Line 62: | Line 97: | ||
\\ | \\ | ||
- | **Solve .onion using Tor** (Enable Tor first): As the option | + | **Solve .onion using Tor** This option |
- | **Maximum active DHCP leases:** Maximum allowed active DHCP leases at one time. (Default: 255). | + | FreshTomato has a built-in Tor client. For more information about this, see the TOR |
- | **Static lease time:** The absolute | + | **Maximum active DHCP leases:** Sets the maximum |
- | | + | **Static lease time:** Sets the absolute maximum valid time for any DHCP lease. |
- | * Infinite\\ The Static lease time is infinity | + | |
- | * Custom\\ This allows you to enter a custom Static | + | |
- | **Announce IPv6 on LAN (SLAAC): **Enabling this turns on router advertisements for IPv6 //Stateless Address Autoconfiguration | + | |
+ | * Infinite\\ Static lease time is infinity | ||
+ | * Custom\\ | ||
- | **Announce IPv6 on LAN (DHCP): | + | To retain leases after rebooting the router, please see this [[retain_dhcp_lease_info_after_a_reboot|HOWTO]] for additional information on non-volatile dhcp leases. |
+ | |||
+ | **Announce IPv6 on LAN (SLAAC): **Enabling this turns on router advertisements for IPv6 //Stateless Address Autoconfiguration (SLAAC)// | ||
+ | |||
+ | - The client sends out an RS (router solicitation) ICMP packet. | ||
+ | - The nearest router responds with an RA (router advertisement) packet. | ||
+ | - The client uses the IPv6 prefix from the RA packet as the first 64 bits of its address. It then derives the last 64 bits of its address using the EUI-64 process or a randomization algorithm. | ||
+ | |||
+ | **Announce IPv6 on LAN (DHCP): | ||
**Fast RA mode**: Forces dnsmasq to be always in frequent RA mode. | **Fast RA mode**: Forces dnsmasq to be always in frequent RA mode. | ||
Line 84: | Line 127: | ||
**Mute dhcpv6 logging: **Enabling this stops FreshTomato from logging IPv6 dhcp activity. (Default: Disabled). | **Mute dhcpv6 logging: **Enabling this stops FreshTomato from logging IPv6 dhcp activity. (Default: Disabled). | ||
- | **Mute RA logging: | + | **Mute RA logging: |
\\ | \\ | ||
Line 90: | Line 133: | ||
{{: | {{: | ||
- | **Prevent client auto DoH**: Modern browsers such as Firefox have a built-in function called DNS Over HTTP(s). When DoH is enabled, a browser can completely | + | **Prevent client auto DoH**: Modern browsers such as Firefox have a built-in function called DNS Over HTTP(s). When DoH is enabled, a browser can bypass the system's DNS server. Enabling the Prevent client auto DOH option prevents DoH communication. This is helpful for getting FreshTomato' |
- | **Enable DNS Rebind protection**: | + | **Enable DNS Rebind protection**: |
- | **Forward local domain queries to the upstream DNS**: Enabling this forwards local domains to the router' | + | **Forward local domain queries to the upstream DNS**: Enabling this forwards local domains to the router' |
- | **Enable multicast DNS** (Avahi mDNS): FIXME | + | **Enable multicast DNS:** Checking this enables an implementation of Avahi mDNS. Avahi is system that enables programs to publish and discover services and hosts running on a LAN. It is a zero-configuration implementation which includes multicast service discovery via the mDNS/DNS-SD protocol suite. " |
**Enable reflector** FIXME | **Enable reflector** FIXME | ||
- | **Custom configuration: | + | **Custom configuration: |
+ | |||
+ | |||
+ | ===== TFTP Server ===== | ||
+ | |||
+ | **Enable TFTP**: Enabling this starts dnsmasq' | ||
+ | |||
+ | **TFTP root path**: Text entered here defines where TFTP root is located in the filesystem. | ||
+ | |||
+ | **PXE on LANx (brx)**: Enbables PXE (Pre Boot eXecution Environment) on one or more bridges. PXE was designed for diskless clients. A PXE client can obtain an IP address via DHCP and, once obtained, download boot code via a TFTP location. Syslinux is a good example of how these principles/ | ||
===== DHCP / DNS Notes ===== | ===== DHCP / DNS Notes ===== | ||
- | * Do not use results from: [[https:// | + | * Do not use results from Cloudflare' |
- | * DNSSEC and DNSCrypt / Stubby complement each other. | + | * DNSSEC and DNSCrypt / Stubby complement each other. DNSSEC provides authentication, |