[pve-devel] [PATCH pve-network 0/7] add dhcp support for all zones

[Aaron Lauterer]

A few thoughts from my side after an in-person talk with Stefan.

On  2024-11-13  20:09, Stefan Hanreich wrote:
> I can see this working with Simple and EVPN zone where the host has an
> IP because he is acting as a gateway.
> 
> But for VLAN / QinQ / VXLAN the way it is currently implemented is
> confusing imo, since we are 'abusing' the gateway field for what is
> essentially a bind address for dnsmasq.

In these cases, we should hide the gateway option in the zone settings 
as it doesn't apply at all!

> 
> There is already 'dhcp-dns-server' which configures the DNS server that
> dnsmasq sends. Maybe we could add 'dhcp-default-gateway' as well, so
> users can configure a default gateway that dnsmasq should send for those
> zones if they have a central external firewall in that VLAN.>
> And then maybe make the bind address explicit for VLAN / VXLAN / QinQ by
> moving it from gateway to 'dhcp-bind-address' and document that this
> address is then reserved? This would also solve the IPv6 issue, wouldn't it?

Yep, having it as DHCP options for the subnet would probably be the best 
place in the GUI.
* Gateway
* DNS Server(s)
* DHCP Listening Address

The DHCP listening address would need to be mandatory, while the gateway 
and DNS server announcements are optional.

> 
> Another issue is that the host is sending itself as default gateway and
> DNS server in those zones, which we should probably not do (we turn off
> forwarding on the interfaces, but it also overwrites resolv.conf, which
> can be quite confusing I think). That should be easy to change (I have
> it on my machine already).

If we stick with VLANs as example (should apply for VXLAN & QinQ as 
well), we usually have the gateway and DNS servers outside the PVE host. 
Think, the router/firewall in which all VLANs terminate. The DNS server 
could be on the router/firewall but also on a different machine in the 
network.

We probably don't want to announce any gateway & DNS if those settings 
are empty, just hand out IPs.

> 
> I have the changes ready on my machine, but I wanted to ask for your
> opinion as well, I can also just send them tomorrow and you can review
> them if you like.
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
>