DHCP Relay and the Problem of Relaying over VPN Tunnels

Introduction

A DHCP relay listens for DHCP requests. Instead of replying the request itself, DHCP requests are relayed to a real DHCP server. Replies from DHCP servers are then relayed to DHCP clients as well. The benefit of using a DHCP relay is to collect all network-related configurations (MAC addresses, IP addresses, host names, DHCP configuration, etc.) in one place.

Problem

The dhcp-relay package provided by openSUSE Linux 10.2 does not relay DHCP reply packets from DHCP server, which is connected via an VPN tunnel, to an Ethernet, where DHCP requests originated from.

Cause

The DHCP relay program dhcrelay shipped with openSUSE uses LPF (Linux Packet Filtering) to listen for DHCP reply packets. Unfortunately, it seems that it doesn't work with the VPN tunnel device tun0 created by OpenVPN.

Example 1: dhcrelay not receiving replies

howie:~ # dhcrelay -d -i eth0 -i tun0 10.0.0.1
Internet Systems Consortium DHCP Relay Agent V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
tun0: unknown hardware address type 65534
Listening on LPF/tun0/
Sending on   LPF/tun0/
Listening on LPF/eth0/00:16:76:c4:c4:a1
Sending on   LPF/eth0/00:16:76:c4:c4:a1
Sending on   Socket/fallback
forwarded BOOTREQUEST for 00:0c:29:09:31:54 to 10.0.0.1
forwarded BOOTREQUEST for 00:0c:29:09:31:54 to 10.0.0.1

Solution

Instead of using LPF, dhcrelay can also use Berkeley sockets. A small patch enables this option, and it can also be incorporated in the spec file. A version of the dhcp-relay package that uses Berkeley sockets can also be downloaded here. You can also use the patched dhcp3-relay package compiled for Ubuntu 8.04.1.

Example 2: dhcrelay working correctly

howie:/usr/src/packages/BUILD/dhcp-3.0.5/work.linux-2.2/relay # ./dhcrelay -d -i eth0 -i tun0 10.0.0.1
Internet Systems Consortium DHCP Relay Agent V3.0.5
Copyright 2004-2006 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
tun0: unknown hardware address type 65534
Listening on Socket/tun0
Sending on   Socket/tun0
Listening on Socket/eth0
Sending on   Socket/eth0
Sending on   Socket/fallback
forwarded BOOTREQUEST for 00:0c:29:09:31:54 to 10.0.0.1
forwarded BOOTREPLY for 00:0c:29:09:31:54 to 255.255.255.255
forwarded BOOTREQUEST for 00:0c:29:09:31:54 to 10.0.0.1
forwarded BOOTREPLY for 00:0c:29:09:31:54 to 255.255.255.255

-- Main.chtsai - 15 Jan 2009