Page MenuHomeVyOS Platform

VRF support for Kea-based DHCP server
Closed, ResolvedPublicFEATURE REQUEST

Description

kea dhcp-server does not initialize when some of the interfaces are in a vrf.

using this config:

set interfaces ethernet eth1 address '192.168.1.1/24'
set interfaces ethernet eth2 address '192.168.2.1/24'
set interfaces ethernet eth2 vrf 'test1'
set interfaces ethernet eth3 address '192.168.3.1/24'
set interfaces ethernet eth4 address '192.168.4.1/24'
set interfaces ethernet eth4 vrf 'test2'
set interfaces ethernet eth7 address '192.168.0.1/30'
set service dhcp-server shared-network-name eth1 option default-router '192.168.1.1'
set service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 lease '300'
set service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 range default start '192.168.1.10'
set service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 range default stop '192.168.1.100'
set service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 subnet-id '1'
set service dhcp-server shared-network-name eth2 option default-router '192.168.2.1'
set service dhcp-server shared-network-name eth2 subnet 192.168.2.0/24 lease '300'
set service dhcp-server shared-network-name eth2 subnet 192.168.2.0/24 range default start '192.168.2.10'
set service dhcp-server shared-network-name eth2 subnet 192.168.2.0/24 range default stop '192.168.2.100'
set service dhcp-server shared-network-name eth2 subnet 192.168.2.0/24 subnet-id '2'
set service dhcp-server shared-network-name eth3 option default-router '192.168.3.1'
set service dhcp-server shared-network-name eth3 subnet 192.168.3.0/24 lease '300'
set service dhcp-server shared-network-name eth3 subnet 192.168.3.0/24 range default start '192.168.3.10'
set service dhcp-server shared-network-name eth3 subnet 192.168.3.0/24 range default stop '192.168.3.100'
set service dhcp-server shared-network-name eth3 subnet 192.168.3.0/24 subnet-id '3'
set service dhcp-server shared-network-name eth4 option default-router '192.168.4.1'
set service dhcp-server shared-network-name eth4 subnet 192.168.4.0/24 lease '300'
set service dhcp-server shared-network-name eth4 subnet 192.168.4.0/24 range default start '192.168.4.10'
set service dhcp-server shared-network-name eth4 subnet 192.168.4.0/24 range default stop '192.168.4.100'
set service dhcp-server shared-network-name eth4 subnet 192.168.4.0/24 subnet-id '4'
set vrf bind-to-all
set vrf name management table '100'
set vrf name test1 table '1001'
set vrf name test2 table '1002'

logs show that it fails to initialize on the interfaces that are within a vrf and clients do not get a lease. interfaces on the default vrf are unaffected and dhcp server assigns leases normally.

[...]
Apr 06 16:42:53 kea-dhcp4[2540]: 2024-04-06 16:42:53.647 WARN  [kea-dhcp4.dhcpsrv/2540.140360373832128] DHCPSRV_OPEN_SOCKET_FAIL failed to open socket: Failed to open socket on interface eth2, reason: failed to bind fallback socket to address 192.168.2.1, port 67, reason: Cannot assign requested address - is another DHCP server running?
Apr 06 16:42:53 kea-dhcp4[2540]: 2024-04-06 16:42:53.652 WARN  [kea-dhcp4.dhcpsrv/2540.140360373832128] DHCPSRV_OPEN_SOCKET_FAIL failed to open socket: Failed to open socket on interface eth4, reason: failed to bind fallback socket to address 192.168.4.1, port 67, reason: Cannot assign requested address - is another DHCP server running?
Apr 06 16:42:53 kea-dhcp4[2540]: 2024-04-06 16:42:53.661 WARN  [kea-dhcp4.dhcpsrv/2540.140360373832128] DHCPSRV_OPEN_SOCKET_FAIL failed to open socket: Failed to open socket on interface test1, reason: failed to bind fallback socket to address 127.0.0.1, port 67, reason: Address already in use - is another DHCP server running?
Apr 06 16:42:53 kea-dhcp4[2540]: 2024-04-06 16:42:53.661 WARN  [kea-dhcp4.dhcpsrv/2540.140360373832128] DHCPSRV_OPEN_SOCKET_FAIL failed to open socket: Failed to open socket on interface test2, reason: failed to bind fallback socket to address 127.0.0.1, port 67, reason: Address already in use - is another DHCP server running?
[...]

Details

Version
1.5-rolling-202404030018
Is it a breaking change?
Perfectly compatible
Issue type
Feature (new functionality)

Event Timeline

dmbaturin claimed this task.
Viacheslav triaged this task as Normal priority.
Viacheslav added a subscriber: dmbaturin.

The following can be configured as a quick and dirty workaround:

insert the following lines in the file /config/scripts/vyos-postconfig-bootup.script and restart
(the VRFNAME must be replaced with the desired vrf name)

killall kea-dhcp4
ip vrf exec VRFNAME /usr/sbin/kea-dhcp4 -c /run/kea/kea-dhcp4.conf

I assume that workaround would only work for a single VRF or can one do something like this?

killall kea-dhcp4
ip vrf exec VRF_TEST1 /usr/sbin/kea-dhcp4 -c /run/kea/kea-dhcp4.conf
ip vrf exec VRF_TEST2 /usr/sbin/kea-dhcp4 -c /run/kea/kea-dhcp4.conf

you have to adapt a few more things, if absolutely necessary it also works with several VRFs - but it is very ugly...

/config/scripts/vyos-postconfig-bootup.script

killall kea-dhcp4
cp /run/kea/kea-dhcp4.conf /run/kea/kea-dhcp4-test1.conf
cp /run/kea/kea-dhcp4.conf /run/kea/kea-dhcp4-test2.conf
sed -i 's\*\eth0\g' /run/kea/kea-dhcp4-test1.conf
sed -i 's\*\eth1\g' /run/kea/kea-dhcp4-test2.conf
sed -i 's\dhcp4-ctrl-socket\dhcp4-ctrl-socket-test1\g' /run/kea/kea-dhcp4-test1.conf
sed -i 's\dhcp4-ctrl-socket\dhcp4-ctrl-socket-test2\g' /run/kea/kea-dhcp4-test2.conf
ip vrf exec test1 /usr/sbin/kea-dhcp4 -c /run/kea/kea-dhcp4-test1.conf & ip vrf exec test2 /usr/sbin/kea-dhcp4 -c /run/kea/kea-dhcp4-test2.conf

Tests after reboot

vyos@vyos1:~$ ss -tulpn | grep 67
udp   UNCONN 0      0      10.1.1.1%test1:67        0.0.0.0:*          
udp   UNCONN 0      0      10.2.2.1%test2:67        0.0.0.0:*    

vyos@vyos1:~$ cat /config/dhcp/dhcp4-leases.csv
address,hwaddr,client_id,valid_lifetime,expire,subnet_id,fqdn_fwd,fqdn_rev,hostname,state,user_context,pool_id
10.1.1.100,50:00:00:02:00:00,,86400,1716630302,1,0,0,vyos,0,,0
10.2.2.100,50:00:00:02:00:01,,86400,1716634205,2,0,0,vyos,0,,0

Probably the best way will be moving the config to the vrf section (not implemented)
For example:

set vrf name foo service dhcp-server shared-network-name eth1 option default-router '192.168.1.1'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 lease '300'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 range default start '192.168.1.10'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 range default stop '192.168.1.100'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 subnet-id '1'

And start several instances, each with its configuration.

yes, that would be a very good solution/implementation

Probably the best way will be moving the config to the vrf section (not implemented)
For example:

set vrf name foo service dhcp-server shared-network-name eth1 option default-router '192.168.1.1'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 lease '300'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 range default start '192.168.1.10'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 range default stop '192.168.1.100'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 subnet-id '1'

And start several instances, each with its configuration.

๐Ÿ‘‹ New VyOS user and just ran into this issue myself. Your syntax makes the most sense to me as someone new to VyOS but after standing up the configurations and dealing with the CLI for interfaces within VyOS specifically I would expect something like this:

set service dhcp-server shared-network-name VLAN192 subnet 192.168.1.0/24 default-router '192.168.1.1'
set service dhcp-server shared-network-name VLAN192 subnet 192.168.1.0/24 dns-server '1.1.1.1'
set service dhcp-server shared-network-name VLAN192 vrf HelloWorld

Keeping in line with this type of configuration:

set interfaces bonding bond0 mode 802.3ad
set interfaces bonding bond0 member interface eth0
set interfaces bonding bond0 vif 192 description 'VLAN10'
set interfaces bonding bond0 vif 192 address '192.168.1.1/24'
set interfaces bonding bond0 vif 192 vrf HelloWorld

Probably the best way will be moving the config to the vrf section (not implemented)
For example:

set vrf name foo service dhcp-server shared-network-name eth1 option default-router '192.168.1.1'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 lease '300'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 range default start '192.168.1.10'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 range default stop '192.168.1.100'
set vrf name foo service dhcp-server shared-network-name eth1 subnet 192.168.1.0/24 subnet-id '1'

I think the logic proposed by @Viacheslav make more sense , if you use vrf-aware, there several scenario where you probably have same ip address/subnets or simplest to read when you have many vrf with different DHCP services.

I also ran into this issue and lost a couple of hours trying to figure it out.
I stand for the solution purpose by @Viacheslav .

I'm willing to work on this issue to implement solution proposed by @Viacheslav.

What would be the preferable implementation? My idea is to create separate kea-dhcp[4/6]-server@vrf (and kea-ctrl-agent@vrf) services, as it's done with other features like dhcp-client.
Is this a reasonable approach? Any pitfalls I should watch out for?

Hello! Any news regarding this issue?

@Bonus have you done a solution? I can test it and provide a feedback.

Viacheslav changed the subtype of this task from "Bug" to "Feature Request".Mar 4 2025, 11:33 AM

I have created a merge request: https://github.com/vyos/vyos-1x/pull/4508

It haven't been testes yet - as i have some errros building the ISO image on Win11

dmbaturin renamed this task from kea DHCP server not vrf aware to VRF support for Kea-based DHCP server.Aug 28 2025, 1:45 PM
dmbaturin removed a project: Bugs.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.
dmbaturin changed Issue type from Bug (incorrect behavior) to Feature (new functionality).

Looks like something in this change may be breaking clearing non-VRF DHCP server leases on a config from an upgraded rolling release.

user@er01:~$ clear dhcp-server lease 192.168.1.100
usage: dhcp.py clear_dhcp_server_lease [-h] --family {inet,inet6} --vrf VRF --address ADDRESS
dhcp.py clear_dhcp_server_lease: error: the following arguments are required: --vrf
@er01:~$ clear dhcp-server ?
Possible completions:
  lease                 DHCP server lease
  vrf                   Clear DHCP server lease for vrf


user@er01:~$ show vrf
VRF is not configured
user@er01:~$ clear dhcp-server vrf "" lease 192.168.1.100
usage: dhcp.py clear_dhcp_server_lease [-h] --family {inet,inet6} --vrf VRF --address ADDRESS
dhcp.py clear_dhcp_server_lease: error: argument --vrf: expected one argument
user@er01:~$ clear dhcp-server vrf " " lease 192.168.1.100
usage: dhcp.py clear_dhcp_server_lease [-h] --family {inet,inet6} --vrf VRF --address ADDRESS
dhcp.py clear_dhcp_server_lease: error: argument --vrf: expected one argument
user@er01:~$ clear dhcp-server vrf '' lease 192.168.1.100
usage: dhcp.py clear_dhcp_server_lease [-h] --family {inet,inet6} --vrf VRF --address ADDRESS
dhcp.py clear_dhcp_server_lease: error: argument --vrf: expected one argument
user@er01:~$ clear dhcp-server vrf ' ' lease 192.168.1.100
usage: dhcp.py clear_dhcp_server_lease [-h] --family {inet,inet6} --vrf VRF --address ADDRESS
dhcp.py clear_dhcp_server_lease: error: argument --vrf: expected one argument

user@er01:~$ show system image
Name                     Default boot    Running
-----------------------  --------------  ---------
2025.08.28-0019-rolling  Yes             Yes
2025.08.18-0022-rolling

Began working on a fix for the op_mode commands

Seems that the VRF enforcement is causing issues, and the new draft is moving to the "typing.optional" to make the vrf entry optional.
I still need to test it

https://github.com/vyos/vyos-1x/pull/4689

DHCP-server starts 2 processes when only the VRF is configured T7822
One process with under VRF context and another without VRF, but the file is the same. Looks like a bug.
Check:

vyos@r14# ps ax | grep dhcp | egrep -v grep
  14923 ?        Ss     0:00 sudo /bin/ip vrf exec red /usr/sbin/kea-dhcp4 -c /run/kea/kea-red-dhcp4.conf
  14926 ?        Sl     0:00 /usr/sbin/kea-dhcp4 -c /run/kea/kea-red-dhcp4.conf
[edit]
vyos@r14#

And a client cannot get IP address by DHCP

The lease still cannot be cleared T7823

vyos@r14:~$ show dhcp server leases 
IP Address    MAC address        State    Lease start                Lease expiration           Remaining    Pool    Hostname    Origin
------------  -----------------  -------  -------------------------  -------------------------  -----------  ------  ----------  --------
100.64.2.10   52:54:00:96:17:74  active   2025-09-15 10:47:13+00:00  2025-09-16 10:47:13+00:00  23:57:02     LANv42  r15         local
100.64.2.11   52:54:00:09:0b:01  active   2025-09-15 10:47:28+00:00  2025-09-16 10:47:28+00:00  23:57:17     LANv42  r15         local
vyos@r14:~$ 
vyos@r14:~$ 
vyos@r14:~$ clear dhcp-server lease 100.64.2.10
Failed to clear lease for "100.64.2.10"
vyos@r14:~$ 
vyos@r14:~$ clear dhcp-server lease 100.64.2.11
Failed to clear lease for "100.64.2.11"
vyos@r14:~$ 
vyos@r14:~$ 
vyos@r14:~$ show dhcp server leases 
IP Address    MAC address        State    Lease start                Lease expiration           Remaining    Pool    Hostname    Origin
------------  -----------------  -------  -------------------------  -------------------------  -----------  ------  ----------  --------
100.64.2.10   52:54:00:96:17:74  active   2025-09-15 10:47:13+00:00  2025-09-16 10:47:13+00:00  23:56:52     LANv42  r15         local
100.64.2.11   52:54:00:09:0b:01  active   2025-09-15 10:47:28+00:00  2025-09-16 10:47:28+00:00  23:57:07     LANv42  r15         local
vyos@r14:~$
Viacheslav changed the task status from Open to Needs reporter action.Sep 15 2025, 11:04 AM
Viacheslav assigned this task to davi2367.

Smoketests fail, most likely VRF is not deleted

DEBUG - Running Testcase: /usr/libexec/vyos/tests/smoke/cli/test_vrf.py
DEBUG - test_dhcp_single_pool (__main__.VRFTest.test_dhcp_single_pool) ... FAIL
DEBUG - test_dhcp_single_pool (__main__.VRFTest.test_dhcp_single_pool) ... ERROR
DEBUG - test_dhcpv6_single_pool (__main__.VRFTest.test_dhcpv6_single_pool) ... FAIL
DEBUG - test_dhcpv6_single_pool (__main__.VRFTest.test_dhcpv6_single_pool) ... ERROR
DEBUG - test_vrf_assign_interface (__main__.VRFTest.test_vrf_assign_interface) ... ERROR
DEBUG - test_vrf_assign_interface (__main__.VRFTest.test_vrf_assign_interface) ... ERROR
DEBUG - test_vrf_bind_all (__main__.VRFTest.test_vrf_bind_all) ... ERROR
DEBUG - test_vrf_bind_all (__main__.VRFTest.test_vrf_bind_all) ... ERROR
DEBUG - test_vrf_conntrack (__main__.VRFTest.test_vrf_conntrack) ... ERROR
DEBUG - test_vrf_conntrack (__main__.VRFTest.test_vrf_conntrack) ... ERROR
DEBUG - test_vrf_disable_forwarding (__main__.VRFTest.test_vrf_disable_forwarding) ... ERROR
DEBUG - test_vrf_disable_forwarding (__main__.VRFTest.test_vrf_disable_forwarding) ... ERROR
DEBUG - test_vrf_ip_ipv6_nht (__main__.VRFTest.test_vrf_ip_ipv6_nht) ... ERROR
DEBUG - test_vrf_ip_ipv6_nht (__main__.VRFTest.test_vrf_ip_ipv6_nht) ... ERROR
DEBUG - test_vrf_ip_ipv6_protocol_non_existing_route_map (__main__.VRFTest.test_vrf_ip_ipv6_protocol_non_existing_route_map) ... ERROR
DEBUG - test_vrf_ip_ipv6_protocol_non_existing_route_map (__main__.VRFTest.test_vrf_ip_ipv6_protocol_non_existing_route_map) ... ERROR
DEBUG - test_vrf_ip_protocol_route_map (__main__.VRFTest.test_vrf_ip_protocol_route_map) ... ERROR
DEBUG - test_vrf_ip_protocol_route_map (__main__.VRFTest.test_vrf_ip_protocol_route_map) ... ERROR
DEBUG - test_vrf_ipv6_protocol_route_map (__main__.VRFTest.test_vrf_ipv6_protocol_route_map) ... ERROR
DEBUG - test_vrf_ipv6_protocol_route_map (__main__.VRFTest.test_vrf_ipv6_protocol_route_map) ... ERROR
DEBUG - test_vrf_link_local_ip_addresses (__main__.VRFTest.test_vrf_link_local_ip_addresses) ... ERROR
DEBUG - test_vrf_link_local_ip_addresses (__main__.VRFTest.test_vrf_link_local_ip_addresses) ... ERROR
DEBUG - test_vrf_loopbacks_ips (__main__.VRFTest.test_vrf_loopbacks_ips) ... ERROR
DEBUG - test_vrf_loopbacks_ips (__main__.VRFTest.test_vrf_loopbacks_ips) ... ERROR
DEBUG - test_vrf_static_route (__main__.VRFTest.test_vrf_static_route) ... ERROR
DEBUG - test_vrf_static_route (__main__.VRFTest.test_vrf_static_route) ... ERROR
DEBUG - test_vrf_table_id_is_unalterable (__main__.VRFTest.test_vrf_table_id_is_unalterable) ... ERROR
DEBUG - test_vrf_table_id_is_unalterable (__main__.VRFTest.test_vrf_table_id_is_unalterable) ... ERROR
DEBUG - test_vrf_vni_add_change_remove (__main__.VRFTest.test_vrf_vni_add_change_remove) ... ERROR
DEBUG - test_vrf_vni_add_change_remove (__main__.VRFTest.test_vrf_vni_add_change_remove) ... ERROR
DEBUG - test_vrf_vni_and_table_id (__main__.VRFTest.test_vrf_vni_and_table_id) ... ERROR
DEBUG - test_vrf_vni_and_table_id (__main__.VRFTest.test_vrf_vni_and_table_id) ... ERROR
DEBUG - test_vrf_vni_duplicates (__main__.VRFTest.test_vrf_vni_duplicates) ... ERROR
DEBUG - test_vrf_vni_duplicates (__main__.VRFTest.test_vrf_vni_duplicates) ... ERROR
DEBUG - 
DEBUG - ======================================================================
DEBUG - ERROR: test_dhcp_single_pool (__main__.VRFTest.test_dhcp_single_pool)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_vrf.py", line 73, in tearDown
DEBUG -     self.cli_commit()
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/base_vyostest_shim.py", line 103, in cli_commit
DEBUG -     out = self._session.commit()
DEBUG -           ^^^^^^^^^^^^^^^^^^^^^^
DEBUG -   File "/usr/lib/python3/dist-packages/vyos/configsession.py", line 315, in commit
DEBUG -     out = self.__run_command([COMMIT])
DEBUG -           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
DEBUG -   File "/usr/lib/python3/dist-packages/vyos/configsession.py", line 242, in __run_command
DEBUG -     raise ConfigSessionError(output)
DEBUG - vyos.configsession.ConfigSessionError: [ vrf ]
DEBUG - Can not remove VRF "dhcp_smoke", it still has member interfaces!
DEBUG - delete [ vrf ] failed
DEBUG - Commit failed
DEBUG -

Opened a bug report T7854

sarthurdev changed the status of subtask T7854: VRF smoketest fails from Open to In progress.Sep 23 2025, 5:39 PM
Unknown Object (User) closed this task as Resolved.Oct 8 2025, 12:26 PM
Unknown Object (User) moved this task from Backlog - Bug to Completed on the VyOS Rolling board.