Fix client IP associations in Blocky

deploy/ansible/roles/opnsense/tasks/dnsmasq.yml

@@ -1,18 +1,12 @@
 ---
-# - name: Copy edns0.conf
-#   ansible.builtin.copy:
-#     src: dnsmasq/edns0.conf
-#     dest: "/usr/local/etc/dnsmasq.conf.d/edns0.conf"
-#     owner: root
-#     group: wheel
-#     mode: "0400"
-#     backup: true
-
 - name: Configure dnsmasq
   oxlorg.opnsense.dnsmasq_general:
     enabled: true
     port: 53
+    dhcp_authoritative: true
     dhcp_fqdn: true
+    dhcp_domain: satan.network
+    dhcp_local: true
     dhcpfirst: true
     domain_needed: true
     forward_private_reverse: false
@@ -21,45 +15,64 @@
     resolv_system: true
     strict_order: true
 
+- name: Set DHCP option 6 to Blocky on controller
+  oxlorg.opnsense.dnsmasq_option:
+    description: "[Ansible] DNS server for {{ item.interface }}"
+    type: set
+    option: 6
+    interface: "{{ item.interface }}"
+    value: "{{ item.address }}"
+  loop:
+    - { interface: "LAN", address: "192.168.1.2" }
+    - { interface: "Management", address: "10.2.1.2" }
+    - { interface: "Homelab", address: "10.10.1.2" }
+    - { interface: "IoT", address: "10.100.1.2" }
+
 - name: Create LAN dnsmasq DHCP range
   oxlorg.opnsense.dnsmasq_range:
     description: "[Ansible] LAN DHCP range"
     interface: "LAN"
     start_addr: 192.168.1.50
     end_addr: 192.168.1.254
-    lease_time: 86400
+    lease_time: 3600
 
 - name: Create Management dnsmasq DHCP range
   oxlorg.opnsense.dnsmasq_range:
     description: "[Ansible] Management DHCP range"
     interface: "Management"
     start_addr: 10.2.100.2
     end_addr: 10.2.255.254
-    lease_time: 86400
+    # Stated explicitly rather than derived from the interface, so the mask the
+    # clients get can't drift from the /16 these ranges assume. LAN and Guest
+    # are genuine /24s and keep the auto-calculated mask.
+    subnet_mask: 255.255.0.0
+    lease_time: 3600
 
 - name: Create Homelab dnsmasq DHCP range
   oxlorg.opnsense.dnsmasq_range:
     description: "[Ansible] Homelab DHCP range"
     interface: "Homelab"
     start_addr: 10.10.100.2
     end_addr: 10.10.255.254
-    lease_time: 86400
+    subnet_mask: 255.255.0.0
+    lease_time: 3600
 
 - name: Create Guest dnsmasq DHCP range
   oxlorg.opnsense.dnsmasq_range:
     description: "[Ansible] Guest DHCP range"
     interface: "Guest"
     start_addr: 10.50.0.2
     end_addr: 10.50.0.254
-    lease_time: 86400
+    lease_time: 3600
 
 - name: Create IoT dnsmasq DHCP range
   oxlorg.opnsense.dnsmasq_range:
     description: "[Ansible] IoT DHCP range"
     interface: "IoT"
     start_addr: 10.100.100.1
     end_addr: 10.100.255.254
-    lease_time: 86400
+    subnet_mask: 255.255.0.0
+    lease_time: 3600
 
 - name: Create plex.direct dnsmasq domain
   oxlorg.opnsense.dnsmasq_domain:

hosts/builder/configuration.nix

@@ -49,7 +49,7 @@
         addresses = [
           {
             address = "10.10.2.102";
-            prefixLength = 24;
+            prefixLength = 16;
           }
         ];
       };

hosts/controller/configuration.nix

@@ -58,21 +58,21 @@
       vlan2.ipv4.addresses = [
         {
           address = "10.2.1.2";
-          prefixLength = 24;
+          prefixLength = 16;
         }
       ];
 
       vlan10.ipv4.addresses = [
         {
           address = "10.10.1.2";
-          prefixLength = 24;
+          prefixLength = 16;
         }
       ];
 
       vlan100.ipv4.addresses = [
         {
           address = "10.100.1.2";
-          prefixLength = 24;
+          prefixLength = 16;
         }
       ];
 

hosts/htpc/configuration.nix

@@ -75,7 +75,7 @@
         addresses = [
           {
             address = "10.10.2.101";
-            prefixLength = 24;
+            prefixLength = 16;
           }
         ];
       };

hosts/matrix/configuration.nix

@@ -70,7 +70,7 @@
         addresses = [
           {
             address = "10.10.3.101";
-            prefixLength = 24;
+            prefixLength = 16;
           }
         ];
       };

hosts/omnibus/configuration.nix

@@ -72,7 +72,7 @@
         addresses = [
           {
             address = "10.10.1.101";
-            prefixLength = 24;
+            prefixLength = 16;
           }
         ];
       };

hosts/whirlwind/configuration.nix

@@ -52,7 +52,7 @@
         addresses = [
           {
             address = "10.10.2.103";
-            prefixLength = 24;
+            prefixLength = 16;
           }
         ];
       };

modules/profiles/networking/blocky/default.nix

@@ -1,6 +1,7 @@
 { pkgs, lib, ... }:
 let
-  routerUpstream = "192.168.1.1:5335";
+  unbound = "192.168.1.1:5335";
+  dnsmasq = "192.168.1.1:53";
 in
 {
   imports = [
@@ -89,35 +90,31 @@ in
         maxItemsCount = 0;
       };
       clientLookup = {
-        upstream = routerUpstream;
+        upstream = dnsmasq;
         singleNameOrder = [
           1
           2
         ];
       };
       conditional = {
         mapping = {
-          "1.168.192.in-addr.arpa" = "192.168.1.1:5335";
-          "10.10.in-addr.arpa" = "10.10.0.1:5335";
-          "100.10.in-addr.arpa" = "10.100.0.1:5335";
-          "168.192.in-addr.arpa" = "192.168.1.1:5335";
-          "2.10.in-addr.arpa" = "10.2.0.1:5335";
-          "5.10.in-addr.arpa" = "10.5.0.1:5335";
-          "10.in-addr.arpa" = "192.168.1.1:5335";
-          "arpa" = "192.168.1.1:5335";
-          "." = "192.168.1.1:5335";
+          "satan.network" = dnsmasq;
+          "1.168.192.in-addr.arpa" = dnsmasq;
+          "168.192.in-addr.arpa" = dnsmasq;
+          "2.10.in-addr.arpa" = dnsmasq;
+          "5.10.in-addr.arpa" = dnsmasq;
+          "10.10.in-addr.arpa" = dnsmasq;
+          "100.10.in-addr.arpa" = dnsmasq;
+          "10.in-addr.arpa" = dnsmasq;
+          "." = dnsmasq;
+          "arpa" = unbound;
         };
       };
       prometheus = {
         enable = true;
         path = "/metrics";
       };
       ede.enable = true;
-      ecs = {
-        useAsClient = true;
-        ipv4Mask = 32;
-        ipv6Mask = 128;
-      };
       queryLog.type = lib.mkDefault "console";
     };
   };