Skip to content

Instantly share code, notes, and snippets.

@NiKiZe
Last active Jun 30, 2022
Embed
What would you like to do?
Trying to chainload iPXE with full feature set from a lesser featured one. dnsmasq ProxyDHCP edition
# Known working dnsmasq version 2.85 config for iPXE proxydhcp usage
# things to replace:
# * 10.1.1.0 - your subnet
# * eth0 - interface to listen on, or switch to bind-dynamic
# * 10.1.1.2 - your tftp server ip
# * http://gentoo.ipxe.se/boot.ipxe - script to run once inside iPXE
# Debug logging
log-debug
# Disable DNS server
port=0
# send disable multicast and broadcast discovery, and to download the boot file immediately
# DHCP_PXE_DISCOVERY_CONTROL, should be vendor option? Needs more understanding and source
dhcp-option=vendor:PXEClient,6,2b
# This range(s) is for the public interface, where dnsmasq functions
# as a proxy DHCP server providing boot information but no IP leases.
# Any ip in the subnet will do, so you may just put your server NIC ip here.
dhcp-range=10.1.1.0,proxy
interface=eth0
# bind-dynamic - remove interface and use this instead to listen everywhere?
# Disable re-use of the DHCP servername and filename fields as extra
# option space. That's to avoid confusing some old or broken DHCP clients.
dhcp-no-override
#dhcp-match=set:<tag>,<option number>|option:<option name>|vi-encap:<enterprise>[,<value>]
#dhcp-boot=[tag:<tag>,]<filename>,[<servername>[,<server address>|<tftp_servername>]]
# Based on logic in https://gist.github.com/robinsmidsrod/4008017
# iPXE sends a 175 option, checking suboptions
dhcp-match=set:ipxe-http,175,19
dhcp-match=set:ipxe-https,175,20
dhcp-match=set:ipxe-menu,175,39
dhcp-match=set:ipxe-pxe,175,33
dhcp-match=set:ipxe-bzimage,175,24
dhcp-match=set:ipxe-iscsi,175,17
dhcp-match=set:ipxe-efi,175,36
# set ipxe-ok tag if we have correct combination
# http && menu && iscsi ((pxe && bzimage) || efi)
tag-if=set:ipxe-ok,tag:ipxe-http,tag:ipxe-menu,tag:ipxe-iscsi,tag:ipxe-pxe,tag:ipxe-bzimage
tag-if=set:ipxe-ok,tag:ipxe-http,tag:ipxe-menu,tag:ipxe-iscsi,tag:ipxe-efi
#pxe-service=[tag:<tag>,]<CSA>,<menu text>[,<basename>|<bootservicetype>][,<server address>|<server_name>]
#pxe-prompt=[tag:<tag>,]<prompt>[,<timeout>]
# these create option 43 cruft, which is required in proxy mode
# TFTP IP is required on all dhcp-boot lines (unless dnsmasq itself acts as tftp server?)
pxe-service=tag:!ipxe-ok,X86PC,PXE,undionly.kpxe,10.1.1.2
pxe-service=tag:!ipxe-ok,IA32_EFI,PXE,snponlyx32.efi,10.1.1.2
pxe-service=tag:!ipxe-ok,BC_EFI,PXE,snponly.efi,10.1.1.2
pxe-service=tag:!ipxe-ok,X86-64_EFI,PXE,snponly.efi,10.1.1.2
# later match overrides previous, keep ipxe script last
# server address must be non zero, but can be anything as long as iPXE script is not fetched over TFTP
dhcp-boot=tag:ipxe-ok,http://gentoo.ipxe.se/boot.ipxe,,0.0.0.1
# To use internal TFTP server enabled these, recommended is otherwise atftp
#enable-tftp
#tftp-root=/tftproot/
@NiKiZe
Copy link
Author

NiKiZe commented Aug 5, 2021

Some references linkified:

Tested with real HW, but initial testing was done with:

# BIOS with iPXE preloaded
qemu-system-x86_64 -enable-kvm -M q35 -m 2048 -cpu host -smp 2 -net nic,model=e1000 -net tap,script=no,downscript=no,ifname=tap0 -boot menu=on -usb -vga vmware

# EFI
qemu-system-x86_64 -enable-kvm -M q35 -m 2048 -cpu host -smp 2 -net nic,model=virtio -net tap,script=no,downscript=no,ifname=tap0 -boot menu=on -usb -vga vmware -bios /usr/share/edk2-ovmf/OVMF_CODE.fd

@robinsmidsrod
Copy link

robinsmidsrod commented Aug 5, 2021

@NiKiZe Is this basically a port of my isc-dhcpd config to dnsmasq? It seems familiar, although I'm not so well versed with dnsmasq's syntax.

My personal preference for TFTP server is tftpd-hpa, but whatever floats your boat. :)

@NiKiZe
Copy link
Author

NiKiZe commented Aug 5, 2021

Yes, almost identical in the logic, almost copied over, and thus all the credit to you.
Note though that this is for Proxy DHCP usage only, not when running dnsmasq as full DHCP (that is a different beast)

"# Based on logic in https://gist.github.com/robinsmidsrod/4008017"

One small change is I expect iSCSI support to exist in efi builds as well, not just pcbios.
And then using undionly.kpxe and snponly.efi rather than ipxe.x

I'm sure the internal dnsmasq TFTP could be used as well, might investigate that later, but for now I just wanted the basic part up. (atftp has next to no configuration, and works out of the box in Gentoo)
Also created https://ipxe.org/appnote/proxydhcp, still needs some review.

@robinsmidsrod
Copy link

robinsmidsrod commented Aug 6, 2021

@NiKiZe When I created that example, iSCSI support for EFI didn't exist, hence why it wasn't in that build. ;)

Good job on the proxydhcp setup. Can imagine that is useful for people that have minimal way to configure their existing DHCP server.

@NiKiZe
Copy link
Author

NiKiZe commented Aug 6, 2021

Yes I know, just realized that iSCSI is default now so made that change.

I much prefer dhcpd, just that when you can't modify existing DHCP this is what you need to resort to :/
(even started to look into a freestanding iPXE proxydhcp solution, but in the end got this working, even tho I don't like the menu.)

@robinsmidsrod
Copy link

robinsmidsrod commented Aug 6, 2021

I seem to recall seeing someone trying to implement a DHCP server in Go, primarily for network-booting. Not sure what it was called, but Konobi might've been involved. There is also this Perl CPAN package, https://metacpan.org/pod/Net::DHCP::Packet, that I thought of using at some point to create something, but I never found the time...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment