Bonjour
J’ai un serveur DEBIAN12 derriere une livebox.
J’utilise un DNS privé dans ce serveur, cela fonctionne tres bien.
La livebox a les serveur DNS non modificable.
J’ai donc creer un serveur DHCP dans ce serveur et bien sur desactiver celui de la livebox.
Ma config DNS et DHCP avec DNSMASQ qui fonctionne (car elle tourne sur un raspebrry en attendant et c’est fonctionnel)
#### DNS ####
#query-port=1000
port=53
user=dnsmasq
group=dnsmasq
local=/.lan/
bogus-priv
filterwin2k
localise-queries
strict-order
cache-size=1000
listen-address=192.168.100.240,127.0.0.1
no-negcache
resolv-file=/etc/dnsmasq.d/dnsmasq-dns.conf
no-hosts
addn-hosts=/etc/dnsmasq.d/dnsmasq-hosts.conf
expand-hosts
#log-facility=/var/log/dnsmasq_local.log
#log-queries
#### DHCP ####
#log-dhcp
dhcp-authoritative
dhcp-lease-max=10
dhcp-leasefile=/tmp/dnsmasq.leases
dhcp-range=192.168.100.50,192.168.100.100,24h
dhcp-option=1,255.255.255.0
dhcp-option=3,192.168.100.254
dhcp-option=6,192.168.100.240
dhcp-option=option:ntp-server,192.168.100.240
dhcp-host=3C:BD:D8:D9:03:1C,192.168.100.200
dhcp-host=5C:CF:7F:9F:B0:38,192.168.100.244
dhcp-host=B4:E6:2D:26:EB:36,192.168.100.245
dhcp-host=24:0A:C4:30:CB:10,192.168.100.246
Mon interface via IFCONFIG
eno1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether a8:a1:59:db:xx:xx txqueuelen 1000 (Ethernet)
RX packets 10123234 bytes 8087801668 (7.5 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4996043 bytes 2291678490 (2.1 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
enp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.100.240 netmask 255.255.255.0 broadcast 192.168.100.255
ether a8:a1:59:db:xx:xx txqueuelen 1000 (Ethernet)
Mes regles IPTABLES (partiel), c’est pas propre mais ce n’est pas le soucis
# DHCP
iptables -A INPUT -p udp --dport 67 -j ACCEPT
iptables -A INPUT -p udp --dport 68 -j ACCEPT
# DNS
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
Ma config sysctl.conf que je soupcone fortement
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_synack_retries = 5
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.ip_forward=1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
fs.inotify.max_user_watches = 10000000
fs.protected_fifos = 1
fs.protected_regular = 2
kernel.core_uses_pid = 1
kernel.kptr_restrict = 2
kernel.sysrq = 0
kernel.yama.ptrace_scope = 1
kernel.unprivileged_bpf_disabled = 1
kernel.panic=20
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.log_martians = 1
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1
net.ipv6.conf.all.autoconf = 0
net.ipv6.conf.default.autoconf = 0
net.ipv6.conf.lo.autoconf = 0
net.core.bpf_jit_harden = 2
vm.overcommit_memory=1
Pour info, quand mon serveur est en adresse IP DHCP, il obtient bien l’adresse, mais en tant que serveur (avec une adresse statique defini), rien, pas de bail
Le fichier DNSMASQ est exactement le meme sur mon raspberry temporaire sans la partie DNS.
Si vous avez une piste, je suis preneur.
Merci d’avance