DHCP Kea - Security und Firewall Labor

Installation

• Damit Hosts im LAN automatisch eine IP-Adresse erlangen, konfigurieren wir nun einen DHCP Server (Befehle ab hier finden auf der Firewall statt!)
• dnf install -y kea

Konfiguration

• vim /etc/kea/kea-dhcp4.conf

{
  "Dhcp4": {
    "interfaces-config": {
      "interfaces": ["enp0s9"]
    },
    "option-data": [
      { "name": "domain-name", "data": "it2xx.int" },
      { "name": "domain-name-servers", "data": "10.88.2xx.21" }
    ],
    "valid-lifetime": 7200,
    "subnet4": [
      {
        "id": 1,  
        "subnet": "172.26.2xx.0/24",
        "pools": [{ "pool": "172.26.2xx.50 - 172.26.2xx.70" }],
        "option-data": [
          { "name": "routers", "data": "172.26.2xx.1" }
        ]
      }
    ]
  }
}

• systemctl enable --now kea-dhcp4.service

Status

• systemctl status kea-dhcp4.service

● kea-dhcp4.service - Kea IPv4 DHCP daemon
     Loaded: loaded (/usr/lib/systemd/system/kea-dhcp4.service; enabled)
     Active: active (running) since Wed 2025-04-16 09:27:35 CEST; 29min ago

Mac vom Client rausfinden

anfügen - nicht ersetzen

• cat /var/lib/kea/kea-leases4.csv

Fixe IP

• vi /etc/kea/kea-dhcp4.conf

{
  "Dhcp4": {
    "interfaces-config": {
      "interfaces": ["enp0s9"]
    },
    "option-data": [
      { "name": "domain-name", "data": "it2XX.int" },
      { "name": "domain-name-servers", "data": "10.88.2XX.21" }
    ],
    "valid-lifetime": 7200,
    "subnet4": [
      {
        "id": 1,
        "subnet": "172.26.2XX.0/24",
        "pools": [{ "pool": "172.26.2XX.50 - 172.26.2XX.70" }],
        "option-data": [
          { "name": "routers", "data": "172.26.2XX.1" }
        ],
        "reservations": [
          {
            "hw-address": "08:00:27:c7:35:47",
            "ip-address": "172.26.2XX.100"
          }
        ]
      }
    ]
  }
}

Die Reservations-Sektion gehört innerhalb des subnet4-Blocks

Den DHCP neustarten

• systemctl restart kea-dhcp4.service

Client neustarten

• sudo reboot

testen ob die IP-Adresse passt