Warda-DNSDocs Warda: from ward — to protect, guardian
v0.9.3
Menu

DHCP server

For the boxes that do not let you change the DNS server they give (Livebox in France, SFR Box, Speedport, Vodafone Station in Germany, Ziggo, Virgin Media, BT, Sky, Starlink), and behind a router that answers the devices itself (eero, Google Nest Wifi, Netgear Orbi, AmpliFi), Warda can give the addresses of the network itself: each device then gets Warda as DNS server, and the box as gateway. It is off by default; the installation assistant (or Network → DHCP server, Turn on) turns it on in three steps:

  1. the address of Warda must be fixed: on the Raspberry Pi image (or any Debian machine run by NetworkManager), warda-system.service makes the current address permanent with nmcli; elsewhere, fix it by hand;
  2. turn the DHCP server of the box off;
  3. Warda checks that no other server answers (a discovery relayed from Warda itself, answered to it on port 67), then restarts with its DHCP server on.

It gives the addresses of the network of the box from the 20th to 5 before the last, for 24 hours, never an address in the ARP table of another machine: first an address never given, searched from the one after the last address offered, then the one expired longest ago. While 1024 offers are pending (an offer is kept a minute), the discoveries of new clients get no answer. A decline (DHCPDECLINE: the address is already used) is taken only for the address offered or leased to that very client: the address is then avoided for an hour. The decline of any other address is ignored (a machine of the network could otherwise take another device's address from it). Network → DHCP server (the menu and the title of the page; up to 0.8.4 DHCP) shows everything on one page: the state of the servers and their figures, the settings (no button to open them), the addresses given now (IPv4 and IPv6, refreshed every 15 seconds) and the reservations. The settings change the range (inside the network, without the address of Warda nor of the box) and the lease (1 hour to 7 days); Warda restarts to apply them (WARDA_DHCP_RANGE=start-end and WARDA_DHCP_LEASE fix them).

The options given with each address (PUT /api/v1/dhcp/settings {"ntp": [...], "search": [...]}):

  • the time servers, 4 addresses at most, often the box (a button adds it): option 42 in IPv4 (IPv4 addresses), option 56 in DHCPv6 (IPv6 ones); WARDA_DHCP_NTP fixes them;
  • the domains searched after the local domain, 6 at most (the domain of a business): option 119 in IPv4 (within 200 bytes, so that the answer stays within the 576 bytes every client accepts), option 24 in DHCPv6; WARDA_DHCP_SEARCH fixes them.

Warda stays the DNS server and the box the gateway, whatever the options.

A reservation keeps, for good, an IPv4 address and an IPv6 host part (::50, optional) for a device, by hardware address: from its row in the addresses given (Reserve), or Add a reservation with a device of the list (PUT /api/v1/dhcp/reservations/{mac} {"addr": "192.168.1.50", "host6": "::50"}; without host6, the host part kept stays). No other device gets them.

DHCPv6#

The DHCPv6 server ("dhcp6": true, off by default; WARDA_DHCP6=true) gives each device an IPv6 address (IA_NA, RFC 8415) in the /64 of the network: the one of a global address of Warda first (the prefix of the provider, routed by the box), else a local one (ULA). An address is kept as its host part (the last 64 bits): when the provider changes the prefix, each device keeps the same host part, and a renewal withdraws the old address (lifetimes 0). The host parts given are ::1000 to ::1fff ("range6": "::100-::1ff", WARDA_DHCP6_RANGE), those reserved may be out of the range; the leases follow the lease of IPv4 (preferred for three quarters of it). Warda answers on UDP port 547 of the interface of its network (group ff02::1:2), the clients speaking from their link-local address; it gives itself as DNS server (the address its IPv6 announcements give), the local domain and the domains searched, and the IPv6 time servers. It serves solicit (and rapid commit), request, renew, rebind, confirm, release, decline and information-request; relayed messages are not served. The hardware address of a client is read in its DUID (types 1 and 3) or its EUI-64 link-local address, for the reservations and the names of the devices.

While it runs, the IPv6 announcements of Warda are on and carry the flags M and O (the devices ask their address and settings to DHCPv6): they cannot be turned off from DNS services meanwhile. Android never asks DHCPv6: its devices keep their automatic address (SLAAC) and still get Warda as DNS server by the announcements; the other devices keep their automatic address beside the one of Warda. The leases are kept a month after their end; they stay out of backups, the reservations are in them.

Addresses can be reserved for a device from Network → DHCP server. The devices get a name under the local domain (their name in Warda, else the one they give), answered by Warda, and warda.<domain> is Warda itself. The machines found on the network (network scan, clients seen in the last 24 hours) get a name too, at their current IPv4 address, even without the DHCP server of Warda, refreshed every minute: their own name, else what they are (laserjet-m110), else their maker and the end of their address (samsung-23, device-23), with the end of their address when two have the same name; the names of the DHCP server come first. The local domain is chosen from the language at installation (home.lan, maison.lan, haus.lan, casa.lan, thuis.lan) and changed in Network → Local DNS (WARDA_LOCAL_DOMAIN fixes it). Up to 0.7.9 it had to end with .lan, .home.arpa, .internal or .home, and .local was refused; from 0.7.10 it is free, see The local domain. As soon as it hears another DHCP server (a client choosing it, or an answer to the discovery it sends every 5 minutes), Warda stops giving addresses until that server is gone. If the Warda box stops for good, turn the DHCP server of the box on again: the devices keep their address a day.

A box that announces its own DNS server over IPv6 (Router Advertisements) lets the devices go around Warda: Warda shows it from the resolvers of its machine (from 0.7.10 Warda itself left out, once the box announces it). Up to 0.7.9 the assistant told to turn IPv6, or its DNS server, off on the box; from 0.7.10 the advice is, in this order, to put the IPv6 address of Warda as the IPv6 DNS server of the box, else to turn off only its IPv6 DNS announcement, and IPv6 off as the last resort (see The IPv6 DNS of the box). WARDA_DHCP=true turns the server on from the configuration.