Editing DHCP and NTP for the LAN with systemd-networkd

Handing out addresses on the LAN from the router itself, using the DHCP server
built into systemd-networkd, and pushing the router as the NTP source.

Continues from [[Linux router with WAN, LAN and DMZ]]: '''eth1''' is the LAN at
<code>10.0.1.0/24</code> and the router holds <code>10.0.1.1</code>.

== The DHCP server ==
No extra package — <code>systemd-networkd</code> already has one. Extend the LAN
file, <code>/etc/systemd/network/20-lan.network</code>:

<syntaxhighlight lang="ini">
[Match]
Name=eth1

[Network]
Address=10.0.1.1/24
DHCPServer=yes
ConfigureWithoutCarrier=yes

[DHCPServer]
# Pool starts at the subnet base + offset, so 10.0.1.100 - 10.0.1.199
PoolOffset=100
PoolSize=100

DefaultLeaseTimeSec=1h
MaxLeaseTimeSec=12h

# Gateway. Defaults to this interface's address, so it is only worth
# stating explicitly if the LAN's router is some other box.
EmitRouter=yes

# DNS
EmitDNS=yes
DNS=10.0.1.1

# NTP - the point of the exercise
EmitNTP=yes
NTP=10.0.1.1
</syntaxhighlight>

Apply:
<syntaxhighlight lang="bash">
networkctl reload
networkctl status eth1
</syntaxhighlight>

{{Box|1=<code>PoolOffset=</code> counts from the base of the subnet, not from the router's address. With <code>10.0.1.0/24</code> an offset of 100 starts the pool at <code>10.0.1.100</code>. Keep the pool clear of anything statically addressed.}}

== Fixed addresses ==
One section per host, in the same <code>.network</code> file (systemd 249 and
later):

<syntaxhighlight lang="ini">
[DHCPServerStaticLease]
MACAddress=aa:bb:cc:dd:ee:01
Address=10.0.1.10

[DHCPServerStaticLease]
MACAddress=aa:bb:cc:dd:ee:02
Address=10.0.1.11
</syntaxhighlight>

Static leases should sit outside the dynamic pool — below <code>10.0.1.100</code>
with the pool above, so the two can never collide.

== Serve NTP as well as advertise it ==
<code>NTP=10.0.1.1</code> only tells clients where to look. The router has to
actually answer, which it does not do by default.

With chrony, in <code>/etc/chrony/chrony.conf</code> (Debian) or
<code>/etc/chrony.conf</code> (RHEL):

<syntaxhighlight lang="bash">
# Upstream sources
pool 2.pool.ntp.org iburst

# Answer the LAN
allow 10.0.1.0/24

# Serve local time even while upstream is unreachable, so the LAN does not
# lose its time source when the WAN goes down
local stratum 10
</syntaxhighlight>

<syntaxhighlight lang="bash">
systemctl enable --now chronyd    # chrony on Debian/Ubuntu
chronyc sources -v
chronyc clients
</syntaxhighlight>

The router's own firewall has to let NTP in. The rule is already in the
[[Linux router with WAN, LAN and DMZ#Services on the router itself|baseline
policy]]:

<syntaxhighlight lang="bash">
iptables -A INPUT -i eth1 -p udp --dport 123 -j ACCEPT
</syntaxhighlight>

{{Box|type=warning|1=Never <code>allow</code> a network reachable from the WAN. An NTP server open to the internet is a reflection-amplification tool, and it will be found and used.}}

== Verify ==
On the router:
<syntaxhighlight lang="bash">
# Leases the server has handed out
networkctl status eth1
resolvectl status eth1

# Clients currently talking NTP to us
chronyc clients
</syntaxhighlight>

On a LAN client:
<syntaxhighlight lang="bash">
# Did the NTP option arrive?
resolvectl status            # systemd-resolved: DNS servers
timedatectl show-timesync    # ServerAddress should be 10.0.1.1
timedatectl timesync-status

# Raw lease, if the client runs networkd
networkctl status <iface>
</syntaxhighlight>

A client that ignores the pushed NTP server almost always has one configured
statically — check <code>NTP=</code> in <code>/etc/systemd/timesyncd.conf</code>,
which takes precedence over anything DHCP supplies.

== If you outgrow it ==
The networkd server is deliberately small: one pool per interface, no relay, no
option-82, no failover, no dynamic DNS updates. Reach for '''Kea''' (the ISC
successor to <code>dhcpd</code>) or '''dnsmasq''' when you need any of those.
dnsmasq is the shorter jump — it does DHCP, DNS forwarding and TFTP in one
process, which suits a small router.

[[Category:Networking]]
[[Category:Linux]]
[[Category:Howto]]