<div dir="ltr"><span class="gmail-im" style="color:rgb(80,0,80)"><br></span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Working on ISC but not dnsmasq reinforces my diagnosis: dhcpd bypasses<br>iptables for such packets, dnsmasq doesn't.</blockquote><div><br></div><div>I have no rules on either of the machines with iptables:</div><div><br>root@dns:~# iptables -L<br>Chain INPUT (policy ACCEPT)<br>target prot opt source destination <br><br>Chain FORWARD (policy ACCEPT)<br>target prot opt source destination <br><br>Chain OUTPUT (policy ACCEPT)<br>target prot opt source destination <br>root@dns:~# iptables -L -t nat<br>Chain PREROUTING (policy ACCEPT)<br>target prot opt source destination <br><br>Chain INPUT (policy ACCEPT)<br>target prot opt source destination <br><br>Chain OUTPUT (policy ACCEPT)<br>target prot opt source destination <br><br>Chain POSTROUTING (policy ACCEPT)<br>target prot opt source destination <br> </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 15 Apr 2020 at 00:35, Simon Kelley <<a href="mailto:simon@thekelleys.org.uk">simon@thekelleys.org.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
<br>
On 14/04/2020 18:51, Josh H wrote:<br>
> Hi there,<br>
> <br>
> I'm receiving no DHCPOffer back from my DHCPDiscover. However, I can<br>
> tcpdump the machine running dnsmasq and it is receiving the DHCPOffer<br>
> packets. <br>
> <br>
> Here's my very very simple dnsmasq.conf<br>
> # To disable dnsmasq's DNS server functionality.<br>
> port=0<br>
> <br>
> # To enable dnsmasq's DHCP server functionality.<br>
> dhcp-range=192.168.1.3,192.168.1.8,255.255.255.240,12h<br>
> <br>
> # Set gateway as Router. Following two lines are identical.<br>
> #dhcp-option=option:router,192.168.0.1<br>
> dhcp-option=3,192.168.0.1<br>
> <br>
> # Set DNS server as Router.<br>
> dhcp-option=6,192.168.0.1<br>
> <br>
> # Logging.<br>
> log-facility=/var/log/dnsmasq.log # logfile path.<br>
> log-async<br>
> log-queries # log queries.<br>
> log-dhcp # log dhcp related messages.<br>
> <br>
> Here's the contents of /var/log/dnsmasq.log after running dhclient on a<br>
> machine connected to the subnet:<br>
> Apr 14 18:36:57 dnsmasq[1702]: started, version 2.80 DNS disabled<br>
> Apr 14 18:36:57 dnsmasq[1702]: compile time options: IPv6 GNU-getopt<br>
> DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC<br>
> loop-detect inotify dumpfile<br>
> Apr 14 18:36:57 dnsmasq-dhcp[1702]: DHCP, IP range 192.168.1.3 --<br>
> 192.168.1.8, lease time 12h<br>
> <br>
<br>
So, nothing logged indicating that the DHCPDiscover has been recieved?<br>
If not, my guess would be an iptables rules blocking incoming packets<br>
sent to 255.255.255.255.<br>
<br>
> I can see the service running with netstat -anp4:<br>
> Active Internet connections (servers and established)<br>
> Proto Recv-Q Send-Q Local Address Foreign Address <br>
> State PID/Program name <br>
> udp 0 0 <a href="http://0.0.0.0:67" rel="noreferrer" target="_blank">0.0.0.0:67</a> <<a href="http://0.0.0.0:67/" rel="noreferrer" target="_blank">http://0.0.0.0:67/</a>> <br>
> 0.0.0.0:* 1702/dnsmasq <br>
> udp 0 0 <a href="http://0.0.0.0:1701" rel="noreferrer" target="_blank">0.0.0.0:1701</a> <<a href="http://0.0.0.0:1701/" rel="noreferrer" target="_blank">http://0.0.0.0:1701/</a>> <br>
> 0.0.0.0:* 1607/xl2tpd <br>
> <br>
> There are no firewalls setup anywhere on my network for the moment. I<br>
> have been able to get isc-dhcp-server to successfully allocate DHCP<br>
> requests just fine however, so I don't think it's anything broken with<br>
> DHCP in general. I'm running Linux kernel 5.6.2 and using dnsmasq from<br>
> Debian Bullseye.<br>
<br>
Working on ISC but not dnsmasq reinforces my diagnosis: dhcpd bypasses<br>
iptables for such packets, dnsmasq doesn't.<br>
<br>
<br>
<br>
Cheers,<br>
<br>
Simon.<br>
<br>
<br>
> <br>
> Hopefully someone can work out my issue!<br>
> Thank you very much!<br>
> <br>
> _______________________________________________<br>
> Dnsmasq-discuss mailing list<br>
> <a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
> <a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</a><br>
> <br>
<br>
_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</a><br>
</blockquote></div>