DNS/DHCP(at)WorkYou decide the answers. Including the wrong ones.
A DNS and DHCP server for test networks and labs. It answers from your own zones and records, and gives wrong answers when you ask it to: NXDOMAIN, SERVFAIL, no answer, slow answers or truncated answers. So you can see how phones, printers, servers and software cope when name lookups and address assignment fail.
| Question | Type | Answer | Time | Result |
|---|---|---|---|---|
| gw.lab.test | A | – | – | waiting |
| ntp.lab.test | A | – | – | waiting |
| _sip._udp.lab.test | SRV | – | – | waiting |
| www.example.com | A | – | – | waiting |
The DNS server
0.1.0 · draftDNS over UDP and TCP with your own zones and records, and rules that give wrong answers on purpose. Everything is controlled from a web GUI in English and Norwegian, and every query shows up in the log as it happens.
- Answers
- From your own zones and records: A, AAAA, CNAME, MX, TXT, SRV, PTR and NS, with wildcards (
*.app.lab.test) and automatic reverse lookups. Names that do not exist in the zone get NXDOMAIN. - Answers wrong
- Rules per name pattern, type and client network:
NXDOMAIN,SERVFAIL,REFUSED, no answer, a slow answer, a truncated answer (TC) or another address. The first rule that matches decides. - Forwards
- Names outside the zones can be forwarded to another DNS server. Without forwarding the test network is closed, and the server answers REFUSED.
- Shows
- "Ask the DNS server" shows the answer a client would get, without sending anything. The log shows client, question, answer, rule and time for every query.
- Protects
- Login, CSRF protection and a strict CSP. The service runs as its own user, with only the rights it needs for ports 53 and 67 and to bind DHCP to one network card.
The DHCP server
IPv4Hands out addresses in one network, directly or through a DHCP relay, and can behave like a broken DHCP server. It is off after installation and is turned on in the web GUI.
- Hands out
- Address pool, subnet mask, router, DNS, domain and lease time, and options 42 (NTP), 66 (TFTP) and 67 (boot file) for PXE and IP phones. Fixed addresses per MAC address.
- Answers wrong
- Fault modes:
silent(never answers),nak(rejects every request),delayandexhausted(no free addresses). - Names
- A client that says it is
laptop-annagetslaptop-anna.lab.testin DNS while the lease lasts. - Shows
- Leases with state and time left, and every DISCOVER, OFFER, REQUEST, ACK and NAK in the log.
Only on a test network. A DHCP server answers everybody who asks on the network segment. That is why DHCP is off after installation, and the web GUI asks again before it is turned on.
Test scenarios
Point the test equipment at the server, make a rule and watch what happens. A test goes like this:
- Point the clients at the server
Set the DNS server in the equipment, or turn on DHCP so the clients get it automatically.
- Add the records
The names the equipment needs, for example
sip.lab.test,ntp.lab.testand SRV records. - Make a rule
Choose the name, optionally type and client, and what should happen. "Add an example" gives ready-made rules.
- Watch the log
Every query and DHCP message is shown with answer, rule and time. Does the client retry? Over TCP? Does it give up?
big.lab.test first got TC over UDP and then an answer over TCP.| Test | Set-up |
|---|---|
| IP phone without a SIP server | Rule SERVFAIL or NXDOMAIN on _sip._udp.lab.test. Does the phone switch to the backup server, and what does it show? |
| DNS that does not answer | Rule DROP on *. How long does the client wait, and does it try the next DNS server? |
| Slow DNS | Rule DELAY with 3000 ms. Find the limit where the application gives up or feels slow to the user. |
| TCP fallback | Rule TRUNCATE. The client must ask again over TCP – does that get through the firewall? |
| Wrong address | Rule ANSWER that sends www.example.com to a sinkhole address. |
| Only one client fails | Clients field 10.0.0.66. The rest of the test network gets normal answers. |
| No IPv6 answers | Rule DROP on type AAAA. Does the client fall back to IPv4 quickly? |
| DHCP that does not answer | Fault mode "silent". The client ends up with 169.254.x.x – how long does it take, and what does it log? |
| NAK loop | Fault mode "nak". The client gets an offer, but the request is rejected, again and again. |
| PXE and phones | Options 66 and 67 with TFTP server and boot file, and a fixed address per MAC address. |
| DHCP through a relay | The router with ip helper-address forwards; the reply goes back through the relay agent. |
Installation
One offline package with no dependencies other than Python 3, which comes with Rocky Linux 9. The installer checks the checksums and that the ports are free, creates a password, opens the firewall and ends by checking the web GUI and DNS.
Rocky Linux 9, physical or VM
$ sha256sum -c DNS-DHCP-Tester-0.1.0-offline.tar.gz.sha256
$ tar xzf DNS-DHCP-Tester-0.1.0-offline.tar.gz
$ cd DNS-DHCP-Tester-0.1.0
$ sudo ./install.sh
# open http://<server>:8053/ – user admin, the password is printedNo pip, no containers and no internet. Run install.sh again to upgrade; settings, leases, log and password are kept. --admin-net 10.10.0.0/24 opens the web port only for the management network.
VMware and Proxmox VE
# VM with one network card on the test network (e.g. ens224)
$ scp DNS-DHCP-Tester-0.1.0-offline.tar.gz* root@vm:/root/
$ ssh root@vm
# tar xzf DNS-DHCP-Tester-*.tar.gz && cd DNS-DHCP-Tester-0.1.0
# ./install.sh
# python3 /opt/dns-dhcp-tester/tools/selftest.py1 vCPU and 1 GB of memory is enough. Give the VM its own network card in the test network's VLAN, and choose it as the DHCP interface in the web GUI. The DHCP server then only answers on that network.
Port 53 in use? The installer shows which process uses it (often dnsmasq from libvirt). Stop it, or use --dns-listen <address> or --dns-port. Ports 8053, 53 and 67 do not collide with the other (at)Work tools, so they can all run on the same server.
Screenshots
The web GUI is available in English and Norwegian and also works on phones. The pictures here are from the English version; the Norwegian page shows Norwegian screenshots. Click to see the full-size picture.