{"id":41,"date":"2010-09-16T21:34:57","date_gmt":"2010-09-16T08:34:57","guid":{"rendered":"http:\/\/www.templesoft.co.nz\/blog\/?p=41"},"modified":"2026-04-08T08:19:32","modified_gmt":"2026-04-07T20:19:32","slug":"using-bind9-and-dhcp3-to-setup-a-dynamic-dns-solution","status":"publish","type":"post","link":"https:\/\/templesoft.co.nz\/journal\/?p=41","title":{"rendered":"Using BIND9 and DHCP3 to setup a dynamic DNS solution."},"content":{"rendered":"<h2 style=\"text-align: justify;\">Background<\/h2>\n<p style=\"text-align: justify;\">For the last four years I&#8217;ve been using the DHCP and DNS server roles on my Microsoft 2003 R2 server to form a DDNS (Dynamic DNS) solution and it&#8217;s been working well. It&#8217;s a fairly simple setup where:<\/p>\n<ul>\n<li>A client device on the local subnet makes a DHCP request.<\/li>\n<li>DHCP server responds with an IP lease.<\/li>\n<li>The IP address is passed to the forward and reverse lookup zone of the DNS for resolution.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">No mystery what&#8217;s happening there. For the server in question, the roles had expanded to include being an AD master, WSUS server and web server for our intranet, again nothing too major for a small organisation. BUT&#8230; one of my constant gripes was the time it took the server to load after each restart. Some cursory research pointed to the fact that it was waiting for the DNS server to startup and that was causing some delays\/problems for the AD. To add to motivation, there was only one DNS server, which meant when it went down&#8230; NO DNS RESOLUTION!<\/p>\n<p style=\"text-align: justify;\">So the idea was born to recycle a few of the Pentium III Dell Optiplex&#8217;s we had gathering dust into a primary DNS servers, with a secondary slave. I didn&#8217;t want to load Windows Server onto these boxes because (A) They were too low spec, and (B) I didn&#8217;t want to breach licencing obligations.<\/p>\n<p style=\"text-align: justify;\">Ubuntu to the rescue.<\/p>\n<p style=\"text-align: justify;\">It&#8217;s no secret I like Ubuntu with its solid packages and extensive support, so the 32-bit version of the server software was perfect for what I wanted to do. The plan: Two boxes running BIND9 (the DNS service) and one running DHCP3-SERVER, with updates from &#8220;Master&#8221; to &#8220;Slave&#8221; and the same forward and reverse lookup zones I have with Windows.<\/p>\n<h3 style=\"text-align: justify;\">The Base OS Install<\/h3>\n<p style=\"text-align: justify;\">The specifications of your hardware are dependant on the size of your organisation and the ultimately the number of &#8220;requests&#8221; you expect to get. We&#8217;re only small and I only needed it to service resolution for the internal subnet so the PIII&#8217;s were going to be fine. I threw as much memory into the units as I could, but based on some of the reading it should be &gt;= 320MB.<\/p>\n<p style=\"text-align: justify;\">The OS install was standard, with me defining a static IP address and configuring a SWAP size of 2x the amount of physical RAM. At the end of Ubuntu&#8217;s install you can select the DNS server as additional software to be installed but for this guide I&#8217;ll assume you didn&#8217;t.<\/p>\n<p style=\"text-align: justify;\">Once the install is finished it&#8217;s a good idea to check for any updates.<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude update\r\nsudo aptitude safe-upgrade<\/pre>\n<h3 style=\"text-align: justify;\">Packages<\/h3>\n<p style=\"text-align: justify;\">First, we need <strong>BIND9<\/strong>, and I also include the <strong>dnsutils<\/strong> packages for testing and troubleshooting.<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude install bind9 dnsutils<\/pre>\n<p style=\"text-align: justify;\">Next, the DHCP3 package.<\/p>\n<pre style=\"text-align: justify;\">sudo aptitude install dhcp3-server<\/pre>\n<h2>Primary Master<\/h2>\n<h3>Overview<\/h3>\n<p style=\"text-align: justify;\">There a many ways to configure <strong>BIND9<\/strong>. Some of the most common configurations are a caching nameserver, primary master, and as a secondary master.<\/p>\n<p style=\"text-align: justify;\">When configured as a caching nameserver <strong>BIND9<\/strong> will find the answer to name queries and remember the answer when the domain is queried again.<\/p>\n<p style=\"text-align: justify;\">As a primary master server <strong>BIND9<\/strong> reads the data for a zone from a file on it&#8217;s host and is authoritative for that zone.<\/p>\n<p style=\"text-align: justify;\">In a secondary master configuration <strong>BIND9<\/strong> gets the zone data from another nameserver authoritative for the zone.<\/p>\n<h3 style=\"text-align: justify;\">Preliminary setup<\/h3>\n<p style=\"text-align: justify;\">The first thing we do is setup a few references and settings in BIND9&#8217;s conf file. Note: some lines may already be present in the file, so make sure you avoid duplicates.<\/p>\n<pre>cd \/etc\/bind\r\nsudo vi named.conf\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">acl \"trusted\" {<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\"><em><strong>    1.2.3.0\/24<\/strong><\/em>;<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">    localhost;<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">    localnets;<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">};<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">controls {<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        inet 127.0.0.1 allow {127.0.0.1; <em><strong>1.2.3.4<\/strong><\/em>; } keys { \"rndc-key\"; } ;<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">};<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">include \"\/etc\/bind\/named.conf.options\";<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">include \"\/etc\/bind\/named.conf.local\";<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">include \"\/etc\/bind\/named.conf.default-zones\";<\/span><\/pre>\n<p>In the lines above, we have created an &#8220;access control list&#8221; called trusted, and told BIND9 that it relates to the subnet <strong>1.2.3.0\/24<\/strong> (which is in CIDR format and equals <strong>1.2.3.0\/255.255.255.0<\/strong> in the more common &#8220;subnet mask&#8221; format), the localhost, and any localnets. This is fairly open and if you wanted to you could restrict in even further by inclusion of specific IP addresses.<\/p>\n<p style=\"text-align: justify;\">The controls statement declares control channels to be used by system administrators to control the operation of the nameserver. You can find an expanded definition here if you like. The include lines should be included in the file by default.<\/p>\n<p style=\"text-align: justify;\">Since this nameserver isn&#8217;t replicating the entire internet, the first thing we do is to configure it to act as a &#8220;Caching Nameserver&#8221; (described above).<\/p>\n<pre>sudo vi named.conf.options\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">forwarders {<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\"><em>        <strong>9.8.7.6<\/strong><\/em>;<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\"><em>        <strong>5.4.3.2<\/strong><\/em>;<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">};<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">auth-nxdomain no;    # conform to RFC1035<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">listen-on-v6 { none; };<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">listen-on { <em><strong>1.2.3.4<\/strong><\/em>; };<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">allow-query { trusted; };<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">allow-recursion { trusted; };<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">allow-query-cache { trusted; };<\/span><\/pre>\n<p>You can find an expanded definition of the options used <a href=\"http:\/\/www.bind9.net\/manual\/bind\/9.3.2\/Bv9ARM.ch06.html#controls_statement_definition_and_usage\">here<\/a>. The important part here is that <strong>9.8.7.6<\/strong> and <strong>5.4.3.2<\/strong> should be replaced with the IP addresses of actual nameservers (i.e. your ISP&#8217;s nameserver is always good!)<\/p>\n<h3 style=\"text-align: justify;\">Forward Zone File<\/h3>\n<p style=\"text-align: justify;\">A forward zone allows DNS to resolve a name to an address. To add a DNS zone to BIND9, turning BIND9 into a Primary Master server, the first step is to edit<\/p>\n<pre>sudo vi etc\/bind\/named.conf.local\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">include \"\/etc\/bind\/rndc.key\";<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">zone \"local.example\" {<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        type master;<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        file \"\/var\/lib\/bind\/<em><strong>local.example<\/strong><\/em>.zone\";<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        allow-update { key \"rndc-key\"; };<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        allow-transfer {<em><strong>1.2.3\/24<\/strong><\/em>; };<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">};<\/span><\/pre>\n<blockquote><p><span style=\"color: #ff6600;\">WARNING:<\/span><\/p>\n<p><span style=\"color: #ff6600;\">AppArmor only allows read rights in <strong>\/etc\/bind<\/strong> but allows read\/write in <strong>\/var\/lib\/bind<\/strong> and <strong>\/var\/cache\/bind<\/strong>. So unless you want to play around with the AppArmor settings (not a big deal), then put your zone file(s) in the latter locations. If you check the AppArmor profile in <strong>\/etc\/appamor.d\/<\/strong> it defines <strong>\/var\/lib\/bind<\/strong> for dynamically updated zone (and journal) files (which is what I consider these files to be&#8230;) and <strong>\/var\/cache\/bind<\/strong> is for slave\/stub data.<\/span><\/p><\/blockquote>\n<p style=\"text-align: justify;\">Now use an existing zone file as a template to create the <strong>\/var\/lib\/bind\/example.com.zone<\/strong> file.<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/etc\/bind\/db.local \/var\/lib\/bind\/<em><strong>local.example<\/strong><\/em>.zone<\/pre>\n<p style=\"text-align: justify;\">Edit the new zone file <strong>\/var\/lib\/bind\/<em>local.example<\/em>.zone<\/strong> and change localhost. to the FQDN of your server, leaving the additional &#8220;.&#8221; at the end. Change 127.0.0.1 to the nameserver&#8217;s IP Address and root.localhost to a valid email address, but with a &#8220;.&#8221; instead of the usual &#8220;@&#8221; symbol, again leaving the &#8220;.&#8221; at the end.<\/p>\n<pre>sudo vi \/var\/lib\/bind\/<em><strong>local.example<\/strong><\/em>.zone\r\n\r\n$ORIGIN .\r\n$TTL 86400      ; 1 day\r\n<em><strong>local.example<\/strong><\/em>           SOA  ns.<em><strong>local.example<\/strong><\/em>. root.<em><strong>local.example<\/strong><\/em>. (\r\n                                <strong>2<\/strong>          ; serial\r\n                                604800     ; refresh (1 week)\r\n                                86400      ; retry (1 day)\r\n                                2419200    ; expire (4 weeks)\r\n                                86400      ; minimum (1 day)\r\n                                )\r\n                        NS      ns.<strong>local.example<\/strong>.\r\n$ORIGIN local.example.\r\nns           A       <em><strong>1.2.3.4<\/strong><\/em><\/pre>\n<p style=\"text-align: justify;\">You must increment the Serial Number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, simply increment the Serial once. Now, you can add DNS records to the bottom of the zone file as required. Note: the use of the label &#8220;<strong>IN<\/strong>&#8221; refers to an &#8220;<strong>internet<\/strong>&#8221; record.<\/p>\n<p style=\"text-align: justify;\">Once you have made a change to the zone file, BIND9 will need to be restarted for the changes to take effect.<\/p>\n<pre style=\"text-align: justify;\">sudo \/etc\/init.d\/bind9 restart<\/pre>\n<p style=\"text-align: justify;\">It is also a good idea to add the IP address of this nameserver to its own resolv.conf so it can resolve against itself.<\/p>\n<pre style=\"text-align: justify;\">sudo vi \/etc\/resolv.confsearch local.example\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">nameserver <em><strong>1.2.3.4<\/strong><\/em><\/span><\/pre>\n<p style=\"text-align: justify;\">Try a forward lookup to see if it works.<\/p>\n<pre style=\"text-align: justify;\">dig host.<em><strong>local.example<\/strong><\/em><\/pre>\n<h3 style=\"text-align: justify;\">Reverse Zone File<\/h3>\n<p style=\"text-align: justify;\">Now that the zone is setup and resolving names to IP Adresses a reverse zone is also required. A reverse zone allows DNS to resolve an address to a name.<\/p>\n<pre>sudo vi \/etc\/bind\/named.conf.local\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">zone \"<em><strong>3.2.1<\/strong><\/em>.in-addr.arpa\" {<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        type master;<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        file \"\/var\/lib\/bind\/rev.<em><strong>3.2.1<\/strong><\/em>.in-addr.arpa\";<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        allow-update { key \"rndc-key\"; };<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">        allow-transfer {<em><strong>1.2.3\/24<\/strong><\/em>;};<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">};<\/span><\/pre>\n<p>Replace <strong>3.2.1<\/strong> with the first three octets of whatever network you are using. Also, name the zone file <strong>\/var\/lib\/bind\/rev.3.2.1.in-addr.arpa<\/strong> appropriately. In this example it matches the first three octets of your network.<\/p>\n<p style=\"text-align: justify;\">Now create the <strong>\/var\/lib\/bind\/rev.3.2.1.in-addr.arpa<\/strong> file.<\/p>\n<pre style=\"text-align: justify;\">sudo cp \/etc\/bind\/db.127 \/var\/lib\/bind\/rev.<em><strong>3.2.1<\/strong><\/em>.in-addr.arpa<\/pre>\n<p style=\"text-align: justify;\">Next edit <strong>\/var\/lib\/bind\/rev.<em>3.2.1<\/em>.in-addr.arpa<\/strong> basically changing the same options as <strong>\/var\/lib\/bind\/<em>local.example<\/em>.zone<\/strong>.<\/p>\n<pre>sudo vi \/var\/lib\/bind\/rev.3.2.1.in-addr.arpa\r\n\r\n<span style=\"color: #339966; padding-left: 30px;\">$ORIGIN .<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">$TTL 86400      ; 1 day<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\"><strong>3.2.1<\/strong>.in-addr.arpa           SOA  ns.local.example. root.local.example. (<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\"><strong>                                2<\/strong>          ; serial<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">                                604800     ; refresh (1 week)<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">                                86400      ; retry (1 day)<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">                                2419200    ; expire (4 weeks)<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">                                86400      ; minimum (1 day)<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">                                )<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">                        NS      ns.<strong>local.example<\/strong>.<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">$ORIGIN 3.2.1.in-addr.arpa.<\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">1           PTR       ns.<strong>local.example.<\/strong><\/span>\r\n<span style=\"color: #339966; padding-left: 30px;\">2           PTR       <strong>another.local.example.<\/strong><\/span><\/pre>\n<blockquote>\n<p style=\"text-align: justify;\"><span style=\"color: #ff6600;\"><strong>IMPORTANT:<\/strong><\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #ff6600;\"><strong><span style=\"text-decoration: underline;\">REMEMBER<\/span> TO INCLUDE THE TRAILING PERIOD<\/strong> (&#8220;.&#8221;) at the end of each hostname.<\/span><\/p>\n<\/blockquote>\n<p style=\"text-align: justify;\">You <strong><span style=\"text-decoration: underline;\">must<\/span> <\/strong>increment the serial number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, simply increment the Serial once. For each <strong>A<\/strong> record you configure in <strong>\/var\/lib\/bind\/local.example.zone<\/strong> you need to create a <strong>PTR<\/strong> record in <strong>\/var\/lib\/bind\/rev.3.2.1.in-addr.arpa<\/strong>.<\/p>\n<p style=\"text-align: justify;\">Once you have made a change to the zone file, BIND9 will need to be restarted for the changes to take effect.<\/p>\n<pre style=\"text-align: justify;\">sudo \/etc\/init.d\/bind9 restart<\/pre>\n<p style=\"text-align: justify;\">Important note on manually changing zone files<\/p>\n<p style=\"text-align: justify;\">We have created a small headache for ourselves now &#8211; or rather we will once we enable the dynamic updates to the zone files.<\/p>\n<p style=\"text-align: justify;\">All changes made to a zone using dynamic updates are stored in the zone&#8217;s journal file. This file is automatically created by the server when the first dynamic update takes place. The name of the journal file is formed by appending the extension .jnl to the name of the corresponding zone file. It&#8217;s worthwhile mentioning the journal file is in binary format and should not be edited manually.<\/p>\n<p style=\"text-align: justify;\">The server will also occasionally write (&#8220;dump&#8221;) the complete contents of the updated zone to its zone file. This is not done immediately after each dynamic update, because that would be too slow when a large zone is updated frequently. Instead, the dump is delayed by up to 15 minutes, allowing additional updates to take place.<\/p>\n<p style=\"text-align: justify;\">When a server is restarted after a shutdown or crash, it will replay the journal file to incorporate into the zone any updates that took place after the last zone dump.<\/p>\n<p style=\"text-align: justify;\">Changes that result from incoming incremental zone transfers are also journalled in a similar way.<\/p>\n<p style=\"text-align: justify;\">The zone files of dynamic zones cannot normally be edited by hand because they are not guaranteed to contain the most recent dynamic changes &#8211; those are only in the journal file.<\/p>\n<p style=\"text-align: justify;\">Furthermore, editing by hand and altering the serial number may result in a mismatch with the journal file and prevent the BIND9 process from starting.<\/p>\n<p style=\"text-align: justify;\">The only way to ensure that the zone file of a dynamic zone is up to date is to run:<\/p>\n<pre style=\"text-align: justify;\">rndc stop<\/pre>\n<p style=\"text-align: justify;\">If you have to make changes to a dynamic zone manually, disable dynamic updates to the zone using:<\/p>\n<pre style=\"text-align: justify;\">rndc freeze <strong>zone<\/strong><\/pre>\n<p style=\"text-align: justify;\">This will also remove the zone&#8217;s <strong>.jnl<\/strong> file and update the master file.<\/p>\n<p style=\"text-align: justify;\">Edit the zone file, then run<\/p>\n<pre style=\"text-align: justify;\">rndc unfreeze <strong>zone<\/strong><\/pre>\n<p style=\"text-align: justify;\">to reload the changed zone and re-enable dynamic updates. For consistancy, it&#8217;s probably a good idea to reload the <strong>BIND9 <\/strong>process.<\/p>\n<pre>sudo \/etc\/init.d\/bind9 restart<\/pre>\n<h2>Secondary Master<\/h2>\n<p style=\"text-align: justify;\">Once a Primary Master has been configured a Secondary Master is needed in order to maintain the availability of the domain should the Primary become unavailable.<\/p>\n<p style=\"text-align: justify;\">Install the BIND9 package the same way as on the Primary. Then edit the <strong>\/etc\/bind\/named.conf.local<\/strong> and add the following declarations for the Forward and Reverse zones.<\/p>\n<pre>sudo vi etc\/bind\/named.conf.local\r\n\r\n<span style=\"color: #339966;\">include \"\/etc\/bind\/rndc.key\";\r\nzone \"<strong>local.example<\/strong>\" {\r\n        type <strong>slave<\/strong>;\r\n        file \"\/var\/lib\/bind\/<strong>local.example<\/strong>.zone\";\r\n        masters {<strong>1.2.3.4<\/strong>; };\r\n};\r\nzone \"<strong>3.2.1<\/strong>.in-addr.arpa\" {\r\n        type <strong>slave<\/strong>;\r\n        file \"\/var\/lib\/bind\/<strong>rev.3.2.1<\/strong>.in-addr.arpa\";\r\n        masters {<strong>1.2.3.4<\/strong>; };\r\n};<\/span><\/pre>\n<p style=\"text-align: justify;\">I also add the forwarders to the Secondary so that in the event the Primary does go down it can resolve internet addresses as well!<\/p>\n<pre>sudo vi named.conf.options\r\n\r\n<span style=\"color: #339966;\">forwarders {<\/span>\r\n<span style=\"color: #339966;\"><strong>        9.8.7.6<\/strong>;<\/span>\r\n<span style=\"color: #339966;\"><strong>        5.4.3.2<\/strong>;<\/span>\r\n<span style=\"color: #339966;\">};<\/span>\r\n<span style=\"color: #339966;\">auth-nxdomain no;    <span style=\"color: #c0c0c0;\"># conform to RFC1035<\/span><\/span>\r\n<span style=\"color: #339966;\">listen-on-v6 { none; };<\/span>\r\n<span style=\"color: #339966;\">listen-on { <strong>1.2.3.5<\/strong>; };    <span style=\"color: #c0c0c0;\"># this is the address of the secondary<\/span><\/span><\/pre>\n<p>Restart BIND9 on the Secondary Master&#8230;<\/p>\n<pre>sudo \/etc\/init.d\/bind9 restart<\/pre>\n<p>and in <strong>\/var\/log\/syslog<\/strong> you should see something similar to this<\/p>\n<pre><span style=\"color: #339966;\">slave zone \"<strong>local.example<\/strong>\" (IN) loaded (serial 6)<\/span>\r\n<span style=\"color: #339966;\">slave zone \"<strong>3.2.1<\/strong>.in-addr.arpa\" (IN) loaded (serial 3)<\/span><\/pre>\n<blockquote><p><span style=\"color: #ff6600;\">NOTE:<\/span><\/p>\n<p><span style=\"color: #ff6600;\">A zone is only transferred if the serial number on the <strong>Primary<\/strong> is larger than the one on the <strong>Secondary<\/strong>.<\/span><\/p><\/blockquote>\n<h2>DHCP server<\/h2>\n<h3>Overview<\/h3>\n<p style=\"text-align: justify;\">As you&#8217;re probably already aware, the Dynamic Host Configuration Protocol (DHCP) is a network service that enables host computers to be automatically assigned settings from a server as opposed to manually configuring each network host. Computers configured to be DHCP clients have no control over the settings they receive from the DHCP server, and the configuration is transparent to the computer&#8217;s user.<\/p>\n<p style=\"text-align: justify;\">The most common settings provided by a DHCP server to DHCP clients include:<\/p>\n<ul style=\"text-align: justify;\">\n<li>IP-Address and Netmask<\/li>\n<li>DNS<\/li>\n<li>WINS<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">However, a DHCP server can also supply configuration properties such as:<\/p>\n<ul style=\"text-align: justify;\">\n<li>Host Name<\/li>\n<li>Domain Name<\/li>\n<li>Default Gateway<\/li>\n<li>Time Server<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">The advantage of using DHCP is that changes to the network, for example a change in the address of the DNS server, need only be changed at the DHCP server, and all network hosts will be reconfigured the next time their DHCP clients poll the DHCP server. As an added advantage, it is also easier to integrate new computers into the network, as there is no need to check for the availability of an IP address. Conflicts in IP address allocation are also reduced.<\/p>\n<p style=\"text-align: justify;\">In this section we will configure the DHCP3 server with some basic options, and also to dynamically update the DNS server (refered to as <strong>DDNS<\/strong>) with each lease it issues.<\/p>\n<h3 style=\"text-align: justify;\">Installation<\/h3>\n<p style=\"text-align: justify;\">If you haven&#8217;t done it already, at a terminal prompt, enter the following command to install dhcpd:<\/p>\n<pre>sudo aptitude install dhcp3-server<\/pre>\n<p>You will probably need to change the default configuration by editing <strong>\/etc\/dhcp3\/dhcpd.conf<\/strong> to suit your needs and particular configuration.<\/p>\n<p>You also need to edit <strong>\/etc\/default\/dhcp3-server<\/strong> to specify the interfaces dhcpd should listen to. By default it listens to <em>eth0<\/em>.<\/p>\n<h3>Configuration<\/h3>\n<p>First we need to get the <strong>rndc.key<\/strong> file from the <strong>\/etc\/bind<\/strong> directory so that it can be used for authenticating the updates.<\/p>\n<pre>sudo cp \/etc\/bind\/rndc.key \/etc\/dhcp3\/\r\nsudo chown root:dhcpd rndc.key\r\nsudo vi \/etc\/dhcp3\/dhcpd.conf<\/pre>\n<p>Turn on DDNS and tell the DHCP3 server to use the <strong>rndc.key<\/strong> file&#8230;<\/p>\n<pre><span style=\"color: #339966;\">ddns-update-style interim;<\/span>\r\n<span style=\"color: #339966;\">ddns-updates <strong>on<\/strong>;<\/span>\r\n<span style=\"color: #339966;\">ddns-domainname \"<em><strong>local.example<\/strong><\/em>\";<\/span>\r\n<span style=\"color: #339966;\">ddns-rev-domainname \"in-addr.arpa\";<\/span>\r\n<span style=\"color: #339966;\">include \"<strong>\/etc\/dhcp3\/rndc.key<\/strong>\";<\/span><\/pre>\n<p>Then, add the forward and reverse zone information.<\/p>\n<blockquote><p><span style=\"color: #ff6600;\">WARNING:<\/span><\/p>\n<p><span style=\"color: #ff6600;\">Take care to include the trailing period in the &#8220;zone&#8221; directive below<\/span>.<\/p><\/blockquote>\n<pre><span style=\"color: #339966;\">zone <strong>local.example.<\/strong> {\r\n        primary <strong>1.2.3.4<\/strong>;\r\n        key rndc-key;\r\n}\r\nzone <strong>3.2.1<\/strong>.in-addr.arpa. {\r\n        primary <strong>1.2.3.4<\/strong>;\r\n        key rndc-key;\r\n}<\/span><\/pre>\n<p>Now, tell the clients that this DNS server is the authority for this domain&#8230;<\/p>\n<pre><span style=\"color: #339966;\">authoritative;<\/span><\/pre>\n<p>and lastly, define some DHCP options for the client to use.<\/p>\n<pre><span style=\"color: #339966;\">subnet <strong>1.2.3.0<\/strong> netmask 255.255.255.0 {\r\n        range <strong>1.2.3.30<\/strong> <strong>1.2.3.50<\/strong>;\r\n        option subnet-mask 255.255.255.0;\r\n        option broadcast-address 255.255.255.254;\r\n        option domain-name \"<strong>local.example<\/strong>\";\r\n        option domain-name-servers <strong>1.2.3.4<\/strong>, <strong>1.2.3.5<\/strong>;\r\n        option netbios-name-servers <strong>1.2.3.1<\/strong>; <span style=\"color: #c0c0c0;\"># this is your WINS server if you have one<\/span>\r\n        one-lease-per-client on;\r\n        default-lease-time 43200; \r\n        max-lease-time 43200;\r\n        option routers <strong>1.2.3.254<\/strong>;\r\n}<\/span><\/pre>\n<p>When you&#8217;re happy with the settings that will be issued to your clients, restart both the <strong>BIND9<\/strong> and <strong>DHCP3<\/strong> processes.<\/p>\n<pre>sudo \/etc\/init.d\/bind9 restart\r\nsudo \/etc\/init.d\/dhcp3-server restart<\/pre>\n<h3>A last word on Windows settings?<\/h3>\n<p style=\"text-align: justify;\">I found that if the Windows client was configured to try and update the DNS by itself, it would cause an error in the <strong>\/var\/log\/syslog<\/strong> by the named process.<\/p>\n<p style=\"text-align: justify;\">What&#8217;s worst, the DNS update would fail and I was unable to resolve the machine.<\/p>\n<p style=\"text-align: justify;\"><a href=\"http:\/\/www.templesoft.co.nz\/journal\/wp-content\/uploads\/2010\/09\/advancedTCPIPsettings.png\"><img loading=\"lazy\" decoding=\"async\" width=\"406\" height=\"483\" class=\"alignright wp-image-56\" src=\"http:\/\/www.templesoft.co.nz\/journal\/wp-content\/uploads\/2010\/09\/advancedTCPIPsettings.png\" alt=\"Windows advanced TCPIP settings\" \/><\/a>Easy fix:<\/p>\n<ol>\n<li>Open the &#8220;<strong>Local Area Connection Properties<\/strong>&#8221; for the NIC wanting the lease.<\/li>\n<li>Locate the &#8220;<strong>Internet Protocol (TCP\/IP)<\/strong>&#8221; or &#8220;<strong>Internet Protocol 4 (TCP\/IPv4)<\/strong>&#8221; in Vista\/Win7.<\/li>\n<li>Click the &#8220;<strong>Advanced&#8230;<\/strong>&#8221; button.<\/li>\n<li>Click the &#8220;<strong>DNS<\/strong>&#8221; tab.<\/li>\n<li>Make sure that the sections highlighted opposite are configured with the same settings.<\/li>\n<\/ol>\n<p style=\"text-align: justify;\">The most important setting (of course) being the last one, which tells the machine to try and register its IP address in the DNS server servicing it (or not as this case demonstrates).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Background For the last four years I&#8217;ve been using the DHCP and DNS server roles on my Microsoft 2003 R2 server to form a DDNS (Dynamic DNS) solution and it&#8217;s been working well. It&#8217;s a fairly simple setup where: A client device on the local subnet makes a DHCP request. DHCP server responds with an&#8230;  <a class=\"excerpt-read-more\" href=\"https:\/\/templesoft.co.nz\/journal\/?p=41\" title=\"Read Using BIND9 and DHCP3 to setup a dynamic DNS solution.\">Read more &raquo;<\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-41","post","type-post","status-publish","format-standard","hentry","category-technical-resource"],"_links":{"self":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/41","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=41"}],"version-history":[{"count":8,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/41\/revisions"}],"predecessor-version":[{"id":176,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=\/wp\/v2\/posts\/41\/revisions\/176"}],"wp:attachment":[{"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/templesoft.co.nz\/journal\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}