1

I would like to setup my PXE server to attribute a correct IP-address, only for clients requesting network boot.

Therefor I've configured my network adapter with 2 IP addresses on a different range. 192.168.1.19 is the general network that broadcast on /24

For the PXE server boot I'm trying to use another set of IP's to separate it from the rest of the network configuration. The server has therefor a second IP 192.168.0.19 broadcast on /24 for only 2 IP range. (max. 2 computers using PXE boot together)

# cat /etc/network/interfaces
iface enp5s0 inet static
address 192.168.1.19
netmask 255.255.255.0
gateway 192.168.1.1

iface enp5s0:1 inet static
address 192.168.0.19
netmask 255.255.255.0

The point would be, that only computers that request boot should have one of those 2 IP's. Although, it lease it and doesn't release it, even after reboot. I've to manually reset the network on client. Even then, it gets the same IP back sometimes. It's narrow, because my router is set on 192.168.1.1. I presumed it should give priority to the same range.

If network boot is disabled on client it should get an IP from the general network range to get file sharing and other LAN services. If it's on, it should get one for the PXE boot configuration only and release after it's done.

Second test to get it to work:

I've been testing to make this configuration work with dnsmasq instead. Here you'll find my current network settings and the other details:

root@lubuton:~# service dnsmasq restart
root@lubuton:~# service dnsmasq status
● dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server
     Loaded: loaded (/lib/systemd/system/dnsmasq.service; enabled; vendor preset: enabled)
     Active: active (running) since Sun 2022-06-19 09:30:18 CEST; 8s ago
    Process: 75253 ExecStartPre=/etc/init.d/dnsmasq checkconfig (code=exited, status=0/SUCCESS)
    Process: 75261 ExecStart=/etc/init.d/dnsmasq systemd-exec (code=exited, status=0/SUCCESS)
    Process: 75270 ExecStartPost=/etc/init.d/dnsmasq systemd-start-resolvconf (code=exited, status=0/SUCCESS)
   Main PID: 75269 (dnsmasq)
      Tasks: 1 (limit: 18871)
     Memory: 652.0K
        CPU: 38ms
     CGroup: /system.slice/dnsmasq.service
             └─75269 /usr/sbin/dnsmasq -x /run/dnsmasq/dnsmasq.pid -u dnsmasq -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new --local-service --trust-anchor=.,20326,8,2,e06d44b80b8f1d39a95c0b0d7c65d08458e88040>

Jun 19 09:30:18 lubuton dnsmasq-dhcp[75269]: DHCP, IP range 192.168.2.31 -- 192.168.2.40, lease time 1h
Jun 19 09:30:18 lubuton dnsmasq-dhcp[75269]: DHCP, IP range 192.168.2.21 -- 192.168.2.30, lease time 1h
Jun 19 09:30:18 lubuton dnsmasq-dhcp[75269]: DHCP, IP range 192.168.2.11 -- 192.168.2.20, lease time 1h
Jun 19 09:30:18 lubuton dnsmasq-dhcp[75269]: DHCP, IP range 192.168.2.2 -- 192.168.2.10, lease time 1h
Jun 19 09:30:18 lubuton dnsmasq-dhcp[75269]: DHCP, sockets bound exclusively to interface enp5s0
Jun 19 09:30:18 lubuton dnsmasq-tftp[75269]: TFTP root is /srv/tftp
Jun 19 09:30:18 lubuton dnsmasq[75269]: reading /etc/resolv.conf
Jun 19 09:30:18 lubuton dnsmasq[75269]: using nameserver 127.0.0.53#53
Jun 19 09:30:18 lubuton dnsmasq[75269]: read /etc/hosts - 7 addresses
Jun 19 09:30:18 lubuton systemd[1]: Started dnsmasq - A lightweight DHCP and caching DNS server.
lines 1-23/23 (END)
root@lubuton:~# service tftpd-hpa status
● tftpd-hpa.service - LSB: HPA's tftp server
     Loaded: loaded (/etc/init.d/tftpd-hpa; generated)
     Active: active (running) since Sun 2022-06-19 03:27:58 CEST; 6h ago
       Docs: man:systemd-sysv-generator(8)
      Tasks: 1 (limit: 18871)
     Memory: 392.0K
        CPU: 6ms
     CGroup: /system.slice/tftpd-hpa.service
             └─17162 /usr/sbin/in.tftpd --listen --user tftp --address 192.168.2.1:69 --secure --create /srv/tftp

Jun 19 03:27:58 lubuton systemd[1]: Starting LSB: HPA's tftp server...
Jun 19 03:27:58 lubuton tftpd-hpa[17154]:  * Starting HPA's tftpd in.tftpd
Jun 19 03:27:58 lubuton tftpd-hpa[17154]:    ...done.
Jun 19 03:27:58 lubuton systemd[1]: Started LSB: HPA's tftp server.

Client side: PXE-E53: No bootfilename recieved

Here is you can find my default network configuration. This is the /etc/dnsmasq.d/pxe.conf I'm using to setup the PXE-server:

interface=enp5s0,lo
bind-interfaces
log-dhcp
dhcp-host=pxe.home.lan,192.168.2.1
dhcp-range=enp7s4f0,192.168.2.2,192.168.2.10
dhcp-range=enp7s4f1,192.168.2.11,192.168.2.20
dhcp-range=enp8s6f0,192.168.2.21,192.168.2.30
dhcp-range=enp8s6f1,192.168.2.31,192.168.2.40
dhcp-match=set:efi-x86_64,option:client-arch,7
dhcp-boot=tag:efi-x86_64,bootx64.efi,pxelinux.0
enable-tftp
tftp-root=/srv/tftp

I think there's something I do not understand about the PXE network needs about the IP-ranges and subnet.

The point is I would use this PXE to assist people to restore/repair/install/reinstall their operating system.

My home network on 192.168.1.0/24 should remain private. My PXE network should have internet from this last one shared and giving access to clients connected on all other interfaces except enp5s0 connected to ISP router; to the PXE bootp service.

If I understand it right, PXE can only work on WAN IP ranges?

I forgot to mention:

  • I would like that all the computer of my network remains on lan IP's to base ma samba security not on user but on LAN restriction.

  • I can offer the IP's automaticaly on the same range as enp5s0, because this conflics with the router IP leases. So I try to put it on 192.168.2.0/24.

Is it possible or is this the problem?

My last configuration in pxe.conf shares internet, serves IP's to clients at boot, but no file is sended.

interface=enp5s0,lo
bind-interfaces
log-dhcp
dhcp-host=pxe.home.lan,192.168.2.1
dhcp-range=192.168.2.2,192.168.2.40
dhcp-match=set:efi-x86_64,option:client-arch,7
dhcp-boot=tag:efi-x86_64,bootx64.efi,pxelinux.0
enable-tftp
tftp-root=/srv/tftp
0

1 Answer 1

1

I don't think your plan will work the way you want. The OS that gets booted by PXE will typically do its own DHCP network setup. The DHCP client packets from the second network setup probably won't include PXE options.

However, it is certainly possible to detect DHCP client packets with PXE options. This is a common approach so PXE response options can be provided dynamically. What can be done depends on the DHCP service being used.

This is a sample config for isc-dhcp-server DHCP service. It that will offer PXE clients a different pool. It does not offer separate subnets as you want, but it might be adapted.

class "pxeclient" {
    match if substring (option vendor-class-identifier, 0, 9) = "PXEClient";
    filename "pxelinux.0";
}

subnet 192.168.1.0 netmask 255.255.255.0
{
    option routers 192.168.1.1;
    next-server 192.168.1.1;
    max-lease-time 3600;

    pool {
        range 192.168.1.100 192.168.1.109;
        allow members of "pxeclient";
        }

    pool {
        range 192.168.1.110 192.168.1.119;
        allow unknown-clients;
        }
}

Another common DHCP service is dnsmasq. This is a sample config that does the same as above.

log-dhcp
dhcp-option=3,192.168.1.1
dhcp-match=set:pxe,60,PXEClient
dhcp-boot=tag:pxe,pxelinux.0,server,192.168.1.1
dhcp-range=tag:pxe,192.168.1.100,192.168.1.109,255.255.255.0,1h
dhcp-range=tag:!pxe,192.168.1.110,192.168.1.119,255.255.255.0,1h

Other interesting topics include

  • PXE response options based on the PXE client architecture (e.g. BIOS vs UEFI)
  • proxyDHCP service (dnsmasq supports this feature)

Helpful Links

3
  • My current configuration has changed so does my question. Should I modify my current question ? I'm using a network adapter with multiple interfaces that should serve only for iPXE. The default interface serves for internet access and home network.
    – user849355
    Jun 12, 2022 at 0:51
  • @Wingarmac post a new question Jun 12, 2022 at 15:11
  • Hi @AndrewLowther - I've updated my current question instead. I think the problem remains the same. Getting the PXE work on my private network. I've tried to adapt your settings to my current settings, but it didn't make a difference. ics-dhcp as well as dnsmasq didn't bring it up. ics-dhcp could bootp, but no internet, and dnsmasq was inverted, it could share the net, but no bootp or pxlinex.0 recieved by the client.
    – user849355
    Jun 20, 2022 at 0:44

You must log in to answer this question.