Differences

This shows you the differences between two versions of the page.

--- computing:dhcpcd [2026/09/07 16:03] – created oemb1905
+++ computing:dhcpcd [2026/09/07 19:49] (current) – oemb1905
@@ Line 1: / Line 1: @@
-Debian deprecated isc-dhcp-client and replaced it dhcpcd. It took me a bit to figure out how to regulate dhcpcd so it stopped messing with my gateways and dns. Open up ''sudo nano /etc/dhcpcd.conf'' and comment out and/or enter the following:
+-------------------------------------------
+  * **dhcpcd**
+  * **Jonathan Haack**
+  * **Haack's Networking**
+  * **webmaster@haacksnetworking.org**
+-------------------------------------------
+//Managing dhcpcd with ifupdown and Network Manager//
+-------------------------------------------
+Cockpit has advanced logging features for networking but it requires Network Manager. Additionally, Debian deprecated isc-dhcp-client and replaced it dhcpcd. Both of these changes require some tinkering in order to get them to lay off DNS, routes, and gateways. First, make sure that Network Manager is set to manage ifupdown with ''sudo nano /etc/NetworkManager/NetworkManager.conf'':
+<code>
+[main]
+plugins=ifupdown,keyfile
+[ifupdown]
+managed=true
+</code>
+Restart Network Manager ''sudo systemctl restart NetworkManager''. Now, it's time to tell dhcpcd to cease running dns hooks when you restart networking.service. To do that, open up ''sudo nano /etc/dhcpcd.conf'' and comment out dns requests, disable tinkering with resolv.conf, and blacklist gateways on sensitive IoT bridges:
 <code>
@@ Line 17: / Line 39: @@
 </code>
-Once this is done, you make sure Network Manager is managing ifupdown by ''sudo nano /etc/NetworkManager/NetworkManager.conf'':
+You would think this would be enough! But no, Network Manager will still create interfaces for the physical NICs. Unless you edit them, they will request addresses on their untagged subnets. So, first, disable ipv4 and ipv6 on the ethernet interfaces in nm-connection-editor:
-<code>
+{{ :computing:screenshot_20260907_100928.png?direct&600 |}}
-[main]
+{{ :computing:screenshot_20260907_100940.png?direct&600 |}}
-plugins=ifupdown,keyfile
-[ifupdown]
+This stops the interfaces themselves from getting an IP from Network Manager. Do this for all the physical NICs. If you don't do this, then Network Manager will cause gateway issues by assigning these NICs a second IP on those subnets. We are done now, right? Not so fast ... Network Manager will also, by default, pick up DNS via the bridges themselves! So, after all these changes, you need to open each bridge up and specify "address only" mode. Failing to do this will cause Network Manager to rewrite your DNS despite dhcpcd's configurations above. Here's what that looks like:
-managed=true
-</code>
+{{ :computing:screenshot_20260907_101308.png?direct&600 |}}
+{{ :computing:screenshot_20260907_101321.png?direct&600 |}}
+Okay, we are finally done. You can now safely run Network Manager alongside ifupdown and dhcpcd without having your DNS and gateways messed with. Make sure to check your routes and delete any rogue routes Network Manager created and/or that dhcpcd created:
+  ip route show default
+This should show something like:
+  default via 172.50.50.1 dev br2 proto dhcp src 172.33.33.2 metric 1140
+  default via 172.18.18.1 dev br3 proto dhcp src 172.34.34.2 metric 1141
+  default via 10.18.18.1 dev br0 proto dhcp src 10.48.48.2 metric 1142
+Not only did it create routes, it also screwed up priority. Now, if you want these routes, you can set priority in interfaces easily. Personally, I just want the bridges for vms/containers, but want the host to use the private network only. The vms/containers can still use the bridges and vlans/subnets they are connected to. So, for me, I deleted the rogue routes as follows:
+  ip route del default via 172.33.33.1 dev br2 #example
+  ip route del default via 172.34.34.1 dev br3 #example
+After this, I restarted Network Manager, restarted networking and then made sure that everything remained the way I set it up.
+  sudo systemctl restart networking
+  sudo systemctl restart NetworkManager
+  ip route show default
+  default via 10.48.48.1 dev br0 proto dhcp src 10.18.18.2 metric 10
+  cat /etc/resolv.conf
+  nameserver 10.48.48.150
+  nameserver 10.48.48.160
+  nameserver fdf7:e8e6:a2dd:1:325f:5585:a42:8f9c
+  nameserver fdf7:e8e6:a2dd:1:4912:2cc9:8463:ff2c
+You can now reboot, restart each service and DNS is not altered, nor is the gateway. This only took about a year to figure out. It was much easier in isc-dhcp-client; you just prepended your DNS and removed domain-name-servers from the request block and done. Until today, I ran isc-dhcp-client as a temporary solution to avoid figuring this out. Glad it's sorted. Now I can benefit from fully modern Network Manager and logging in Cockpit. Along with custom vnet names, this allows for granular monitoring of vm/container traffic. Additionally, by DNS being unaltered, I can ensure that my hosts stay on the private subnet/vlan and route all traffic through the designate pihole+unbound. And, the vms/containers can tap the bridges and route via the segregated vlans/subnets without issue. Likewise, you can use these same strategies to make sure you don't get sideways traffic on any dual-NIC/purposed IoT devices you have. If you don't do this, Network Manager and dhcpcd will just make DNS and route choices for you and traffic will go wherever based on however it decides to prioritize your router advertisements.
+-------------------------------------------
+=== Update ===
+It is not enough to simply instruct dhcpcd to not set routes for the bridges, you also have to tell Network Manager the same. To do this, open nm-connection-editor and open the routes submenu in each bridge. Click both the options there for all the IoT or restricted bridges; leave the primary or private bridge untouched. Then, restart networking and NetworkManager and you should only see the default route for the private subnet/lan. Here is what that looks like:
+{{ :computing:screenshot_20260907_104547.png?direct&600 |}}
+This worked flawlessly on two machines. However, one machine insisted on making routes no matter what I did. So, for that machine, I additionally stopped Network Manager from doing that using nmcli:
-Then, lastly, you also need to stop Network Manager from messing with DNS. So, first, disable ipv4 and ipv6 on the ethernet interfaces in nm-connection-editor. This stops the interfaces themselves from getting an IP from Network Manager. We don't want this because ifupdown already gives the same subnet an address on the bridge, so no need for the interface to also have an address. Additionally, it can cause gateway issues.
+  nmcli connection modify br1 ipv4.ignore-auto-routes yes ipv6.ignore-auto-routes yes
+  nmcli connection modify br2 ipv4.ignore-auto-routes yes ipv6.ignore-auto-routes yes
+  nmcli connection modify br3 ipv4.ignore-auto-routes yes ipv6.ignore-auto-routes yes
+If you instead want the routes, but just don't want them to be default, then:
+  nmcli connection modify br1 ipv4.never-default yes ipv6.never-default yes
+  nmcli connection modify br2 ipv4.never-default yes ipv6.never-default yes
+  nmcli connection modify br3 ipv4.never-default yes ipv6.never-default yes
-Then, lastly, you want to turn on "address only" mode for all the managed bridges in Network Manager.
+Just adapt this command to whatever your bridges are named. This final change took care of the most stubborn machine I had.
+=== Update to the Update ===
+As it turns out, the above commands were not the fix. The issue was in fact due to phantom route entries that Network Manager populated. In nm-connection-editor > bridges > ipv4 > routes, there were invalid ipv4 entries. After deleting those bogus entries and restarting both services, the phantom routes did not return. In short, make sure there are no entries other than ones you've created in that location! I have no idea where those came from and they were not on every box I updated.
+ --- //[[alerts@haacksnetworking.org|oemb1905]] 2026/09/07 19:40//

Haack's Wiki

User Tools

Site Tools

Differences

Page Tools