I have the following setup on a remote office:
--- vlan interface --- Remote Router --tun0--> Main office Firewall --> Active Directory DHCP
dhcp3-relay to forward dhcp requests(broadcasts) to my main AD server(unicast). Problem is: dhcp request arrives at the Remote Router vlan interface(broadcast), is correctly forwarded through routing to our AD server, an answer is given but when receiving the packet, it isn't internally forwarded from
tun0 to the
vlanXXX interface of the Remote Router where the request originaly came from. Here it is the
tcpdump output from the Remote Router.
tcpdump -i tun0 -nevvv udp port 67 or 68 13:23:45.049995 Out ethertype IPv4 (0x0800), length 592: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 576) IP.VPN.REMOTE.OFFICE.67 > IP.OF.AD.SERVER.67: BOOTP/DHCP, Request from MAC:ADDR:OF:THE:REMOTE:CLIENT, length 548, hops 1, xid 0x2c896edc, secs 11527, Flags [none] (0x0000) Gateway-IP IP.OF.NET.GATEWAY Client-Ethernet-Address MAC:ADDR:OF:THE:REMOTE:CLIENT [|bootp] 13:23:45.145014 In ethertype IPv4 (0x0800), length 350: (tos 0x0, ttl 125, id 24829, offset 0, flags [none], proto UDP (17), length 334) IP.OF.AD.SERVER.67 > IP.OF.NET.GATEWAY.67: BOOTP/DHCP, Reply, length 306, xid 0x2c896edc, Flags [none] (0x0000) Your-IP NEW.LEASE.FROM.AD Server-IP IP.OF.AD.SERVER Gateway-IP IP.OF.NET.GATEWAY Client-Ethernet-Address MAC:ADDR:OF:THE:REMOTE:CLIENT [|bootp]
Here you can see that the packet is correctly forwarded by the
dhcrelay software to our main office, and AD gives a new lease to the host. We already have this solution working on other links that are not openvpn based(mpls) to distribute IPs to remote offices.
tcpdump -i vlanXXX -nevvv udp port 67 or 68 13:21:45.022067 MAC:ADDR:OF:THE:REMOTE:CLIENT > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 147, offset 0, flags [none], proto UDP (17), length 576) 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from MAC:ADDR:OF:THE:REMOTE:CLIENT, length 548, xid 0x496364c3, secs 11407, Flags [none] (0x0000) Client-Ethernet-Address MAC:ADDR:OF:THE:REMOTE:CLIENT [|bootp]
We can only see the broadcast request comming from the host, but not the answer that arrived at
tun0 and should be routed to
Also, Remote Router is pretty permissive with this protocol:
iptables -A INPUT -p udp --sport 67:68 --dport 67 -j ACCEPT iptables -A OUTPUT -p udp --sport 67 --dport 67:68 -j ACCEPT iptables -A FORWARD -p udp --sport 67:68 --dport 67 -j ACCEPT iptables -A FORWARD -p udp --sport 67 --dport 67:68 -j ACCEPT
dhcp3-relay process info:
hafw:~# ps fax | grep dhc 5714 pts/0 D+ 0:00 \_ grep dhc 5087 ? Ss 0:04 /usr/sbin/dhcrelay3 -i vlanxxx IP.OF.AD.SERVER
# Defaults for dhcp3-relay initscript # sourced by /etc/init.d/dhcp3-relay # installed at /etc/default/dhcp3-relay by the maintainer scripts # # This is a POSIX shell fragment # # What servers should the DHCP relay forward requests to? SERVERS="IP.OF.AD.SERVER" # On what interfaces should the DHCP relay (dhrelay) serve DHCP requests? INTERFACES="vlanXXX" # Additional options that are passed to the DHCP relay daemon? OPTIONS=""
hafw:~# dpkg -l | grep dhcp3-relay ii dhcp3-relay 3.1.1-6+lenny6 DHCP relay daemon
What i have already tried to do on relay configuration and didn't change the behavior:
-aoption to append agent info
-c 20and increase the number of hops from the default(10) to 20. Anyway, there are only 8 hops to reach AD.
tun0and the internet vlan interface
vlanYYYthat is facing internet.
INTERFACES=empty so, there will not be a
Am I missing something?