具有多个网络接口和不同子网的 DHCP 服务器

Question

我正在尝试设置一个带有 4 个网络接口eth0-3的 dhcp 服务器（在 debian 8 上的 isc dhcpd（在 esxi 环境中的虚拟机））。dhcp 服务器应该在eth1、eth2、eth3接口上为不同的子网提供服务。每个子网都有自己的 vSwitch (vSphere)，dhcp 服务器连接到每个 vSwitch。

网络接口设置如下所示：

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
    address 192.168.1.100
    netmask 255.255.255.0
    network 192.168.1.0
    broadcast 192.168.1.255
    gateway 192.168.1.1

auto eth1
iface eth1 inet static
    address 10.0.0.1
    netmask 255.255.255.0
    network 10.0.0.0
    broadcast 10.0.0.255

auto eth2
iface eth2 inet static
    address 172.16.0.1
    netmask 255.255.255.0
    network 172.16.0.0
    broadcast 172.16.0.255

auto eth3
iface eth3 inet static
    address 10.0.1.1
    netmask 255.255.255.0
    network 10.0.1.0
    broadcast 10.0.1.255

当前的 dhcpd 配置如下所示：

# dhcpd.conf

default-lease-time 600;
max-lease-time 7200;

subnet 172.16.0.0 netmask 255.255.255.0 {
    range 172.16.0.2 172.16.0.100;
    option subnet-mask 255.255.255.0;
    option domain-name-servers 172.16.0.1;
    option routers 172.16.0.1;
    option broadcast-address 172.16.0.255;
}

subnet 10.0.0.0 netmask 255.255.255.0 {
    range 10.0.0.2 10.0.0.100;
    option subnet-mask 255.255.255.0;
    option domain-name-servers 10.0.0.1;
    option routers 10.0.0.1;
    option broadcast-address 10.0.0.255;
}

subnet 10.0.1.0 netmask 255.255.255.0 {
    range 10.0.1.2 10.0.1.100;
    option subnet-mask 255.255.255.0;
    option domain-name-servers 10.0.1.1;
    option routers 10.0.1.1;
    option broadcast-address 10.0.1.255;
}

最后，dhcpd init 脚本如下所示：

# /etc/default/isc-dhcp-server

DHCPD_CONF=/etc/dhcp/dhcpd.conf
DHCPD_PID=/var/run/dhcpd.pid
INTERFACES="eth1 eth2 eth3"

到现在为止还挺好。但是，目前发生的情况是客户端只能通过 eth1 接口获得 dhcp 流量。其他两个网络接口将被忽略。即使我从 isc-dhcp-server init 脚本中删除了 eth1，它仍然被使用并提供 IP 地址：

isc-dhcp-server[1467]: Starting ISC DHCP server: dhcpd.
dhcpd: DHCPDISCOVER from 00:0a:26:37:6f:12 via eth1
dhcpd: DHCPOFFER on 10.0.0.2 to 00:0a:26:37:6f:12 (client0) via eth1
dhcpd: DHCPREQUEST for 10.0.0.2 (10.0.0.1) from 00:0a:26:37:6f:12 (client0) via eth1
dhcpd: DHCPACK on 10.0.0.2 to 00:0a:26:37:6f:12 (client0) via eth1

如何确保某个网络/子网仅使用特定网络接口提供服务？dhcp 服务器如何知道哪个客户端属于哪个子网？我知道我可以使用主机符号（硬件地址、主机名等）为子网指定主机。但是，对我来说，这违背了 dhcp 的目的，因为我希望能够在每次向子网添加新客户端时动态分配 IP 地址，而不必接触 dhcp 配置。

Answer 1

因此，我们在这里稍微解释一下发生了什么。请注意，我强烈建议在测试环境中运行配置，以确保一切按您想要的方式运行！

编辑：另请注意，您的交换机需要正确配置。我们使用的是CISCO交换机。要生成 OMAPI 密钥，您可以按照guide1或guide2进行操作。

如何使isc-dhcp-server侦听多个子网。本迷你指南将为您提供基本的配置理念和一些额外的材料，供您阅读以充分了解正在发生的情况。

dhcpd.conf：

omapi-port 7911;
omapi-key omapi_key;

key omapi_key {
     algorithm hmac-md5;
     secret your-secret-key;
}

# The ddns-updates-style parameter controls whether or not the server will
# attempt to do a DNS update when a lease is confirmed. We default to the
# behavior of the version 2 packages ('none', since DHCP v2 didn't
# have support for DDNS.)
ddns-update-style none;

# option definitions common to all supported networks...
# option domain-name-servers x.x.x.x,y.y.y.y;
option netbios-node-type 2;

default-lease-time 7200;
max-lease-time 7200;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

# Failover Configuration

failover peer "failover-partner" {
        primary;
        # this servers ip address
        address A.A.A.A;
        port 519;
        # dhcp failover ip address
        peer address B.B.B.B;
        peer port 520;
        max-response-delay 60;
        max-unacked-updates 10;
        mclt 3600;
        split 128;
        load balance max seconds 3;
}

# No service will be given on this subnet, but declaring it helps the
# DHCP server to understand the network topology.

# here we include specific configuration files for our different subnets.
# I'll provide an example for a configuration file, all other subnet configuration files
# are (in my scenario) written the same way.

include "/etc/dhcp/X.Y.1.Z.conf";
include "/etc/dhcp/X.Y.2.Z.conf";
include "/etc/dhcp/X.Y.3.Z.conf";

XY1.Z.conf：

#____________________________________
# subnet information  X.Y.1.0/24
#____________________________________
subnet X.Y.1.0 netmask 255.255.255.0 {
        deny client-updates;
        deny unknown-clients;
        # gateway of this subnet  
        option routers X.Y.1.254;
        # DNS server(s)
        option domain-name-servers 123.123.123.1, 123.123.123.2;
        # search domain(s) for this subnet. Needs the "" to work!
        option domain-search "domain1", "domain2";
        # name of domain of this subnet (if exists, otherwise comment out)
        option domain-name "mydomain";
        # ntp server if you are running one
        option ntp-servers X.Y.Z.254;
        default-lease-time 86400;
        max-lease-time 86400;

        group {
            use-host-decl-names on;

            # Infodisplay
            host dns-name-1 {
            # mac address of client
                hardware ethernet 00:00:00:00:00:00;
            # ip address the above mac address will receive
                fixed-address 123.123.123.1;
            }
       }

子网的其他配置文件也是同样构建的。如果您在 ESXi 内运行 DHCP 虚拟机，请确保该虚拟机可用于所有网络/VLAN。然后， isc -dhcp-server需要侦听它预期的所有网络，以便它可以在 isc-dhcp-server 的一个运行实例中处理所有不同的子网。如果您想省略停机时间或不工作的网络，您当然可以在从模式下使用isc-dhcp-server运行第二个虚拟机，如下所示：

从属 dhcpd.conf：

omapi-port 7911;
omapi-key omapi_key;

key omapi_key {
     algorithm hmac-md5;
     secret your-secret-key;
}

# The ddns-updates-style parameter controls whether or not the server will
# attempt to do a DNS update when a lease is confirmed. We default to the
# behavior of the version 2 packages ('none', since DHCP v2 didn't
# have support for DDNS.)
ddns-update-style none;

# option definitions common to all supported networks...
# option domain-name-servers x.x.x.x,y.y.y.y;
option netbios-node-type 2;

default-lease-time 7200;
max-lease-time 7200;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

# Failover Configuration

failover peer "failover-partner" {
        primary;
        # this servers ip address
        address B.B.B.B;
        port 519;
        # dhcp master ip address
        peer address A.A.A.A;
        peer port 520;
        max-response-delay 60;
        max-unacked-updates 10;
        mclt 3600;
        split 128;
        load balance max seconds 3;
}

# No service will be given on this subnet, but declaring it helps the
# DHCP server to understand the network topology.

# here we include specific configuration files for our different subnets.
# I'll provide an example for a configuration file, all other subnet configuration files
# are (in my scenario) written the same way.

include "/etc/dhcp/X.Y.1.Z.conf";
include "/etc/dhcp/X.Y.2.Z.conf";
include "/etc/dhcp/X.Y.3.Z.conf";

确保两台机器上的密钥相同，否则客户端和服务器将无法通信，甚至在服务器发生故障时无法进行故障转移切换，并且从机预计将接管 dhcp 功能。

如果您有硬件/设置选项，请在实验环境中设置所有这些。

请不要立即在生产环境中运行它。

您可以在几秒钟内停止让您的网络客户端工作，而这是您的老板不会喜欢的。