DHCP Server with isc-kea

Overview

• What you’ll learn: How DHCP works (DORA process), the difference between ISC DHCP and isc-kea, installing and configuring Kea DHCP4 on Ubuntu, subnet declarations, address pools, host reservations, option settings, and lease management.
• Prerequisites: Lesson 17 – Setting Up BIND 9 DNS Server
• Estimated reading time: 22 minutes

Introduction

The Dynamic Host Configuration Protocol (DHCP) automates the assignment of IP addresses, subnet masks, default gateways, DNS servers, and other network parameters to devices on a network. Without DHCP, every device would need its network settings configured manually — an impractical approach for networks of any significant size.

Kea is the modern, open-source DHCP server developed by ISC (Internet Systems Consortium) as the successor to the legacy ISC DHCP server. Kea uses a JSON-based configuration format, supports a REST API for management, and can store leases in a database (MySQL, PostgreSQL, or Cassandra) for high-availability deployments.

In this lesson, you will learn how the DHCP protocol works, install and configure Kea DHCP4 on Ubuntu Server, set up address pools and host reservations, and manage DHCP leases.

How DHCP Works — The DORA Process

DHCP uses a four-step process known as DORA (Discover, Offer, Request, Acknowledge) to assign an IP address to a client:

• Discover: The client broadcasts a DHCPDISCOVER message to find available DHCP servers.
• Offer: DHCP servers respond with a DHCPOFFER containing a proposed IP address and configuration.
• Request: The client broadcasts a DHCPREQUEST accepting one offer and informing other servers.
• Acknowledge: The selected server sends a DHCPACK confirming the lease and configuration.

# Watch DHCP traffic with tcpdump
$ sudo tcpdump -i ens33 -n port 67 or port 68
10:00:01 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request, DISCOVER
10:00:01 IP 192.168.1.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, OFFER
10:00:01 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request, REQUEST
10:00:01 IP 192.168.1.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, ACK

# DHCP uses UDP ports 67 (server) and 68 (client)
$ ss -uln | grep -E '67|68'
UNCONN  0  0  0.0.0.0:67  0.0.0.0:*
UNCONN  0  0  0.0.0.0:68  0.0.0.0:*

Installing Kea DHCP Server

Kea is available in Ubuntu repositories. The package kea-dhcp4-server provides the IPv4 DHCP server.

# Install Kea DHCP4 server
$ sudo apt update
$ sudo apt install -y kea-dhcp4-server

# Verify the installation
$ kea-dhcp4 -V
2.2.0

# Check the service status
$ sudo systemctl status kea-dhcp4-server
● kea-dhcp4-server.service - Kea DHCPv4 Server
     Loaded: loaded (/lib/systemd/system/kea-dhcp4-server.service; enabled)
     Active: active (running)

# Configuration file location
$ ls /etc/kea/
kea-dhcp4.conf  kea-dhcp6.conf  kea-ctrl-agent.conf

Configuring Kea DHCP4

Kea uses a JSON configuration file. The main configuration for DHCPv4 is /etc/kea/kea-dhcp4.conf. You define interfaces to listen on, subnet declarations, address pools, options, and host reservations.

// /etc/kea/kea-dhcp4.conf
{
  "Dhcp4": {
    // Listen on this interface
    "interfaces-config": {
      "interfaces": ["ens33"]
    },

    // Lease database (memfile is simplest; use MySQL/PostgreSQL for HA)
    "lease-database": {
      "type": "memfile",
      "persist": true,
      "lfc-interval": 3600
    },

    // Default lease time (seconds)
    "valid-lifetime": 43200,
    "renew-timer": 21600,
    "rebind-timer": 37800,

    // Subnet declaration
    "subnet4": [
      {
        "id": 1,
        "subnet": "192.168.1.0/24",
        "pools": [
          { "pool": "192.168.1.100 - 192.168.1.200" }
        ],
        "option-data": [
          { "name": "routers", "data": "192.168.1.1" },
          { "name": "domain-name-servers", "data": "192.168.1.10, 8.8.8.8" },
          { "name": "domain-name", "data": "lab.example.com" },
          { "name": "domain-search", "data": "lab.example.com" }
        ],

        // Static reservations by MAC address
        "reservations": [
          {
            "hw-address": "00:0c:29:aa:bb:cc",
            "ip-address": "192.168.1.20",
            "hostname": "web-server"
          },
          {
            "hw-address": "00:0c:29:dd:ee:ff",
            "ip-address": "192.168.1.30",
            "hostname": "db-server"
          }
        ]
      }
    ]
  }
}

# Validate the configuration
$ kea-dhcp4 -t /etc/kea/kea-dhcp4.conf
INFO  DCTL_CONFIG_FILE Configuration file: /etc/kea/kea-dhcp4.conf
INFO  DHCP4_CONFIG_COMPLETE DHCPv4 server configuration complete.

# Restart to apply
$ sudo systemctl restart kea-dhcp4-server

Managing DHCP Leases

Kea stores lease information in its lease database. With the memfile backend, leases are stored in a CSV file. You can inspect, query, and manage leases using the Kea shell or by examining the lease file directly.

# View the lease file (memfile backend)
$ cat /var/lib/kea/kea-leases4.csv
address,hwaddr,client_id,valid_lifetime,expire,subnet_id,fqdn_fwd,fqdn_rev,hostname,state,user_context,pool_id
192.168.1.100,00:0c:29:11:22:33,,43200,1704110400,1,0,0,client1,0,,0
192.168.1.101,00:0c:29:44:55:66,,43200,1704110400,1,0,0,client2,0,,0

# Monitor DHCP activity in the log
$ sudo journalctl -u kea-dhcp4-server -f
DHCP4_LEASE_ALLOC [hwtype=1 00:0c:29:11:22:33] lease 192.168.1.100 allocated
DHCP4_LEASE_ALLOC [hwtype=1 00:0c:29:44:55:66] lease 192.168.1.101 allocated

# Force a client to renew its DHCP lease
$ sudo dhclient -r ens33    # Release current lease
$ sudo dhclient ens33       # Request new lease

# Alternatively with networkctl
$ sudo networkctl renew ens33

Key Takeaways

• DHCP automates IP address assignment using the DORA process (Discover, Offer, Request, Acknowledge) over UDP ports 67 and 68.
• Kea is the modern DHCP server from ISC, using JSON configuration and supporting database backends for high availability.
• Subnet declarations define address pools, DHCP options (gateway, DNS, domain), and lease lifetimes for each network segment.
• Host reservations map MAC addresses to fixed IP addresses, ensuring critical servers always receive the same address.
• Validate configurations with kea-dhcp4 -t before restarting, and monitor lease activity through journal logs and the lease file.

What’s Next

In Lesson 19, you will learn Firewall with ufw and iptables — how to control network traffic, define allow and deny rules, and protect your server using both the simplified ufw interface and the powerful iptables framework.