DHCPv4, DHCPv6, and address assignment

A DHCPv4 server leases an IPv4 address, subnet mask, default gateway, DNS servers, lease duration, and other options. A reservation binds a device identity to the same address. The lease is temporary even when the reservation is stable.

Address: 192.168.1.50
Mask:    255.255.255.0
Gateway: 192.168.1.1
DNS:     192.168.1.1
Lease:   86400 seconds

DHCPv6 can provide addresses in stateful mode and can provide options such as DNS. In stateless mode, hosts form their address with SLAAC and use DHCPv6 for additional information. DHCPv6 does not normally provide the IPv6 default router: hosts learn that from Router Advertisements.

Use reservations for ordinary LAN hosts so the network remains centrally understandable. Use a static address only when you also document the prefix, gateway, DNS, and duplicate-address risk. For IPv6, stable addresses may coexist with temporary privacy addresses; services should bind deliberately and DNS should use an address that remains valid.

First make an address plan on paper. Name the layer-2 network, its IPv4 subnet, its IPv6 /64, its gateway address, the dynamic range, reservations, DNS servers, and the one machine permitted to answer DHCP. A DHCP server is only correct when its answer agrees with the route and DNS design. A lease that gives a client the wrong gateway can make a perfectly valid address unusable.

# Test Kea configuration files before starting their daemons.
kea-dhcp4 -t /etc/kea/kea-dhcp4.conf
kea-dhcp6 -t /etc/kea/kea-dhcp6.conf

# Normal Saphira/OpenRC operation after the test passes.
rc-service kea-dhcp4 start
rc-service kea-dhcp6 start
rc-update add kea-dhcp4 default
rc-update add kea-dhcp6 default

# On a systemd-selected installation, prove a unit is supplied before using it.
systemctl list-unit-files | grep -E '^kea-dhcp(4|6)\.service'

1. 1. Start on a non-production VLAN

   Connect one disposable or non-critical client. Do not introduce a second DHCP server on the office production LAN while the router's DHCP service is still active.

2. 2. Capture the client contract

   Record its IPv4 address, route, resolver, IPv6 addresses, IPv6 default route, and DNS answer. This distinguishes a lease fault from a DNS or firewall fault.

3. 3. Test renewal and reboot

   Renew the lease or reconnect the test client, then restart the address-service host during a maintenance window. A configuration that works only once has not been proved.

# Client evidence: each question has a separate command.
ip -4 addr
ip -4 route
ip -6 addr
ip -6 route
cat /etc/resolv.conf
dig A mail.example.test
dig AAAA mail.example.test

# Packet evidence when the client receives nothing.
tcpdump -ni servergw0 '(port 67 or port 68 or port 546 or port 547 or icmp6)'

• Client gets an address but cannot leave the subnet: the DHCP router/gateway option or gateway forwarding policy is wrong.
• Client gets IPv6 addresses but has no IPv6 default route: RA is missing, filtered, sent from the wrong interface, or rejected by the client; DHCPv6 alone is not the normal route source.
• Different clients receive different DNS answers unexpectedly: find competing DHCP servers, RAs advertising RDNSS, VPN DNS, or resolver-management software.
• A server becomes unreachable intermittently: its manually configured address overlaps the dynamic pool or its reservation identity changed. Move static infrastructure out of the pool and document the reservation.