(code change offer inside) To enable dynamic leases with parameters

[shodanx]

Hi,

I have found a bug in /etc/init.d/dnsmasq

That prevented creating dynamic leases with parameters

because of this line

[ -z "$ip" ] && [ -z "$name" ] && [ -z "$hostid" ] && return 0

Changing the function like this allows dynamic leases without an ip address, hostname (and hostid ? I’m not sure what that is)

dhcp_host_add() {
        local cfg="$1"
        local hosttag nametime addrs duids macs tags mtags

        config_get_bool force "$cfg" force 0

        config_get networkid "$cfg" networkid
        [ -n "$networkid" ] && dhcp_option_add "$cfg" "$networkid" "$force"

        config_get_bool enable "$cfg" enable 1
        [ "$enable" = "0" ] && return 0

        config_get name "$cfg" name
        config_get ip "$cfg" ip
        config_get hostid "$cfg" hostid
        config_get mac "$cfg" mac
        config_get duid "$cfg" duid
        [ -z "$ip" ] && [ -z "$name" ] && [ -z "$hostid" ] && [ -z "$mac" ] && [ -z "$duid" ] && return 0


        config_get_bool dns "$cfg" dns 0
        [ "$dns" = "1" ] && [ -n "$ip" ] && [ -n "$name" ] && {
                echo "$ip $name${DOMAIN:+.$DOMAIN}" >> "$HOSTFILE_TMP"
        }

        config_get tag "$cfg" tag

        add_tag() {
                mtags="${mtags}tag:$1,"
        }
        config_list_foreach "$cfg" match_tag add_tag

        if [ -n "$mac" ]; then
                # --dhcp-host=00:20:e0:3b:13:af,192.168.0.199,lap
                # many MAC are possible to track a laptop ON/OFF dock
                for m in $mac; do append macs "$m" ","; done
        fi

        if [ $DNSMASQ_DHCP_VER -eq 6 ] && [ -n "$duid" ]; then
                # --dhcp-host=id:00:03:00:01:12:00:00:01:02:03,[::beef],lap
                # one (virtual) machine gets one DUID per RFC3315
                duids="id:${duid// */}"
        fi

        if [ -z "$macs" ] && [ -z "$duids" ]; then
                # --dhcp-host=lap,192.168.0.199,[::beef]
                [ -n "$name" ] || return 0
                macs="$name"
                name=""
        fi

        if [ -n "$hostid" ]; then
                hex_to_hostid hostid "$hostid"
        fi

        if [ -n "$tag" ]; then
                for t in $tag; do append tags "$t" ",set:"; done
        fi

        config_get_bool broadcast "$cfg" broadcast 0
        config_get leasetime "$cfg" leasetime

        [ "$broadcast" = "0" ] && broadcast= || broadcast=",set:needs-broadcast"

        hosttag="${networkid:+,set:${networkid}}${tags:+,set:${tags}}$broadcast"
        nametime="${name:+,$name}${leasetime:+,$leasetime}"

        if [ $DNSMASQ_DHCP_VER -eq 6 ]; then
                addrs="${ip:+,$ip}${hostid:+,[::$hostid]}"
                xappend "--dhcp-host=$mtags$macs${duids:+,$duids}$hosttag$addrs$nametime"
        else
                xappend "--dhcp-host=$mtags$macs$hosttag${ip:+,$ip}$nametime"
        fi
}

I have tested this, it is great and works well.

The point is that this allows you to change dhcp options for a range of MAC addresses in my case.

So in my system I have all MAC which match

de:ad:be:ef:*:*

have dhcp option

3,10.0.0.254

which is a non-routing address (later will be a fakeinternet router)

The point is to block internet access to the whole range of MAC address without incumbering the router with IP filtering address, which require static lease management, which I want to avoid as much as possible. And I’ll add my cell phone, TVs and IoT devices by MAC address wildcard.

So I would like to submit this change to this file.

package/network/services/dnsmasq/files/dnsmasq.init

I have made a series of sed commands which apply the change to the original file

see this thread for more details

Re: LUCI - add support for managing tags in DHCP and DNS configuration web page

Ok found why Then this line runs [ -z "$ip" ] && [ -z "$name" ] && [ -z "$hostid" ] && [ -z "$mac" ] && return 0 the $mac variable has not yet been set ! [image] So I will make a command to move both mac and duid before the check and also I will add $duid to the check Ok so first remove the old variable check line sed -i '/\[ -z "\$ip" \] && \[ -z "\$name" \] && \[ -z "\$hostid" \] && return 0/d' /etc/init.d/dnsmasq then remove the two old config mac & duid lines sed -i '/^[[:space:]…

grep -A10 'config_get name "$cfg" name' /etc/init.d/dnsmasqsed -i '/\[ -z "\$ip" \] && \[ -z "\$name" \] && \[ -z "\$hostid" \] && return 0/d' /etc/init.d/dnsmasq
sed -i '/^[[:space:]]*config_get \(mac\|duid\) "\$cfg" \(mac\|duid\)/d' /etc/init.d/dnsmasq
sed -i '/config_get hostid "\$cfg" hostid/a\        config_get mac "$cfg" mac' /etc/init.d/dnsmasq
sed -i '/config_get mac "\$cfg" mac/a\        config_get duid "$cfg" duid' /etc/init.d/dnsmasq
sed -i '/config_get duid "$cfg" duid/a\        [ -z "$ip" ] && [ -z "$name" ] && [ -z "$hostid" ] && [ -z "$mac" ] && [ -z "$duid" ] && return 0' /etc/init.d/dnsmasq
grep -A10 'config_get name "$cfg" name' /etc/init.d/dnsmasq

This resolves this question

Can you get OpenWrt's DHCP to dynamically assign gateway IP based on MAC Address?

.. something like a static IP lease for specific devices, except I need a specific gateway IP assigned to one specific device as an exception. Possible? This is my situation (and why I need this): I recently purchased a VPN service and my intention is to get every device on my home network to access internet via this VPN. Thought it would be straightforward to setup my OpenWrt gateway router as an OpenVPN client then go from there. Everything went well except it turned out my gateway router…

probably this too

Associate MAC address with configurable name

You can't associate MAC addresses with hostnames, however. You can create static DHCP leases, thereby assigning a reserved IP address to DHCP requests originating from a specific MAC address. With this, you can additionally also create local DNS entries (overrides) for your domain (.lan, by default) to point towards your local (or even remote) IPs. The combination of these two should provide you with the desired functionality. Using luci, both are easily available (in a combined form) via "Net…

Can you get OpenWrt's DHCP to dynamically assign gateway IP based on MAC Address?

.. something like a static IP lease for specific devices, except I need a specific gateway IP assigned to one specific device as an exception. Possible? This is my situation (and why I need this): I recently purchased a VPN service and my intention is to get every device on my home network to access internet via this VPN. Thought it would be straightforward to setup my OpenWrt gateway router as an OpenVPN client then go from there. Everything went well except it turned out my gateway router…

maybe this

Port forwards that dynamically follow internal hosts by their DHCP lease/mac address or hostnames?

It would be in this dialog [image] Instead of specifying a destination by IP address, you could write a mac address, hostname or even select a "host" from the dhcp lease for instance dhcp.@host[36]=host dhcp.@host[36].name='screenul' dhcp.@host[36].mac='3C:52:82:DB:AB:97' dhcp.@host[36].ip='192.168.1.230' (also I wonder, it is possible to create a "static" lease without specifying an ip address ?) This would require a event script to update the internal firewall rules when --dhcpscript…

maybe this eventually

Is there yet a reliable solution to port forward to an hostname rather than a (dynamic) IP address?

Hi, Without making a DHCP lease of any kind Is there yet a reliable method to port forward, not to an hardcoded IP address but an hostname ? I am fine with a process making a dns request at a regular interval for each such hostname. I am fine with short interruption periods when the IP address associated with the hostname occurs. It would be great if when the IP address does change in the DNS server, that it would be the DNS server that would inform the port forward rules rather than having…

probably this

Dynamic DHCP but need to skip few mac addresses

Dear Friends, I have this scenario where all my clients get IP address via DHCP, however, I want to ignore / skip few mac addresses when it comes to leasing them an IP. Static leases won't be an answer as I have 200 + clients and this is a requirement for 10 - 20 hosts. Best Regards,

maybe this

Isolating a single host within a zone

I think it's possible to "isolate" a host to some degree by moving it to another subnet. This means the host can't communicate directly with other devices in the LAN using unicast and needs to send the traffic through the router. But the host will still be able to use broadcast to 255.255.255.255 and multicast. Which means it will be able to use Multicast DNS to look up a service, but won't be able to use unicast to connect to the service. This other subnet should be configure as an IP alias, a…

necessary for this, but still not enough

Feature Request : White-list only internet access for new DHCP clients

Hi, If you're like me, you have several hostiles devices that will automaticall self-destruct if ever allowed to use their call-home backdoor on the unfiltered internet. What we need to not accidentally destroy these devices is White List Only internet access for unknown device. Or "DHCP client whitelist", not sure exactly what to call this, it has other uses. So first how to do this. Easy mode is, somehow set default Gateway for dnsmasq either to a unused address on your network, or maybe …

maybe this

Dynamic MAC-based VLAN assignment for OpenWrt network

I'm looking for any documentation or tutorial how to configure dynamic MAC-based VLAN assignent on the OpenWrt router. Precondition: There is main OpenWrt router with 2 VLANs configured on it: LAN, and Guest. Goal details: scenario_1 (default): any device that will be connected to the Ethernet port of OpenWrt router should be auto-assigned to the Guest VLAN (to get Guest IP address). scenario_2: any device that will be connected to the Ethernet port of OpenWrt router AND the MAC address …

maybe this but not enough on its own

Port forwards that dynamically follow internal hosts by their DHCP lease/mac address or hostnames?

It would be in this dialog [image] Instead of specifying a destination by IP address, you could write a mac address, hostname or even select a "host" from the dhcp lease for instance dhcp.@host[36]=host dhcp.@host[36].name='screenul' dhcp.@host[36].mac='3C:52:82:DB:AB:97' dhcp.@host[36].ip='192.168.1.230' (also I wonder, it is possible to create a "static" lease without specifying an ip address ?) This would require a event script to update the internal firewall rules when --dhcpscript…

[Dante]

Why don't you open a PR in a relevant repo instead?

[shodanx]

I’m not familiar with that system.

[frollic]

[OpenWrt Wiki] Submitting patches

[shodanx]

ok, that’s really a lot of text to read …

[brada4]

You have subnets for that. Nothing in improved config management prevents user from changing IP or MAC

[shodanx]

brada4

my solution, which is just fixing a bug in /etc/init.d/dnsmasq

Can isolate one host or a class of hosts in FOUR operations

How do you send a host to another subnet without creating static leases ?

Is it even possible to do that in Luci ?

And when you do that, how do you ping them ?

How does routing work ?

Is my Netgear Wax202 going to try and router 40gbps of traffic through its tiny CPU ?

What is “improved config management“ ?

[brada4]

@shodanx

subnet without creating static

Heard of DHCP relay?

Your sarcasm is misplaced.

[shodanx]

I’m not being sarcastic,

Not creating static lease is precisely the point of my change

It removes the check which prevents dynamic leases that dnsmasq support

instead of my methods of creating a dhcp tag to change the gateway and then apply this tag to individual and ranges of mac addresses,

You suggest that, if I understand what you suggest,

1. create a new interface
2. dedicate a router port to that interface
   (how does that work on a router with only one LAN one WAN port ?)
3. create separate physical network on separate physical ports
4. assign a static IP to that device
5. on a separate subnet
6. run a second dnsmasq instance in dhcp relay mode
7. and set the gateway of that dnsmasq instance to something else
8. setup routing rules between the subnets, which will route interhost traffic through my router’s tiny cpu
9. and now if I want to switch a host between the two gateway, I need to physically go and reconnect cables

Why is that better than

1. Set DHCP Tag to MAC(s),
2. set gateway to DHCP Tag
   ?

Here is all that was needed to enable this

[brada4]

Make a pull request, sed for patch and pictures are totally non-standard approach

btw cidr bcp aka network segmentation turns 20 this year