https://kb.isc.org/docs/cve-2025-40779
"CVE-2025-40779: Kea crash upon interaction between specific client options and subnet selection"
https://github.com/isc-projects/kea/commit/0afd42b5dfb2e547b...
unprotected null pointer use, kea is in C++
I was really impressed. I think the folks who put it together did a good job of addressing the major warts of my experience with isc-dhcp-server.
I'm sure it's a tremendous challenge writing software that's supposed to live up to modern expectations while still attempting to deliver on all of the legacy dependents and their unique use cases.
Makes me think of that article on how Cloudflare wrote their own Golang DNS Server and like some 900 whopping people use LOC records but they still support it
DHCP and DNS go hand in hand in a network, I really struggle to understand why they are not more integrated in otherwise great solutions (such as kea)
Works great. Minimal fuss, efficient setup, little maintenance, I don't have to understand the guts. Everything on my local network is addressable.
Ad blocking at the router is also something you don't want live without once you've gone there but pi-hole is a great solution even if you don't want that.
What worries me with dnsmasq is that it is a personal project maintained on a personal git (by a great person!). Sure, one can fork and whatnot but without several people participating it can fade out pretty quickly.
This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple, pi-hole has a gui that I was already used to and it all works great. So I think about and study other things that need fixing/improving in my life instead.
To flip it, why would I use unbound without pi-hole? What's the win I haven't seen (or even looked at or considered?)
In my experience, the fewer moving parts the better.
I run Unbound on my OPNsense router, and it uses the same blocklists as Pi-hole and the stats page (blocked domains, DNS requests, etc) are the same afaict.
dnsmasq is awesome if you want a one-stop shop for DHCP and DNS for sure.
An overlay like Tailscale MagicDNS might solve this but is complex.
Assigning the same name to 2 IP's (round robin DNS) will mean having to retry the ssh connection if the IP of the inactive interface is returned.
Failover bonding (mode 1) of the wireless and wired interfaces with MAC address spoofing so that the bonded interface maintains a consistent MAC address is reportedly not always supported by WiFi hardware and standards. Bonding may require manual reconfiguration when the laptop moves from the local network where "shortname" is used to an arbitrary WiFi network like airport or coffee shop.
Are there any solutions that satisfy single IP and reliable WiFi at the same time?
Linux used to be able to move the same IP between 2 interfaces depending on which was active. But it looks like advancements in Linux networking have killed this simple solution.
Comments are less positive than here on HN.
I can't comment on the DNS integration, but I might look a bit deeper because it sounds useful.
Not sure this counts as a fork or when it was “reworked” by OpenBSD, though.
I understand Kea has more features so I'm a little curious what I'm missing.
Which one is better to use with OPNsense?
How fancy does a network needs to be before this starts making sense? Who are the target audience for this project?
The main need I had was for a bank. Network functionality is obviously highly important there. Windows updates impacted the dhcp service on one server, which wasn’t an obvious thing till leases started running out the following morning. Multiple DC’s, so set up for HA to avoid issues in the future. It’s almost never needed but great to have when total uptime is key to operations.
Private + Shared = RAM used Program
476.0 KiB + 24.5 KiB = 500.5 KiB dnsmasqI'll be thrilled if the expected DNS integration works and I don't get the side effects I get now from ISC.
So I switched back to the old dhcpd. shrug I'm sure whatever was going on (dunno if it was ISC or Kea or pfsense et. al) has been fixed since then, but I can't upgrade to 2.8 without giving Netgate my personal data[1] so I have to switch to OPNSense anyways.
[1] aside, not to say I really blame Netgate, they do a lot of great work and commit a ton to FreeBSD, and they want to stop people abusing that by selling gateways and such with their work on them, but also...man just let me download the goddamn iso. At least let me compile 2.8 from source! The source isn't even available last I checked! I was fine compiling my own QAT driver. But alas...
[1] "hw-address" here: https://kb.isc.org/docs/what-are-host-reservations-how-to-us...
At work I have a CARP cluster of two elderly Dell servers with a lot of NICS. I have a change logged for next week.
On isc-dhcp, clients got their static reservation straight up.
- [x] Enable DNS Registration (leases will auto-register with the DNS Resolver)
- [x] Enable Early DNS Registration (static mappings will auto-register with the DNS Resolver)
I do not use the "Create a static ARP table entry for this MAC & IP Address pair." option for individual static mappings.
Hopefully this helps you in your troubleshooting.
I’m guessing it’s something in you’re config.
I'm still on isc-dhcp (and not pfsense either) but is there a chance you have two DHCP servers running?
Definitely has a learning curve for odd devices that "support" DHCP, but I've been happy with how it works, its outputs, and how it can easily be segmented.
my solution: create a bridge with your ethernet device and add a dummy device and UP the said summy device, thereby UPing the bridge.