DHCP 服务器传统手动配置参数的问题DHCP基本概念DHCP优点DHCP工作原理客户端使用DHCPv4配置网络接口时网卡将DHCP DISCOVER数据包发送到255.255.255.255广播目标。因为路由器通常不转发该广播地址所以必须将DHCP服务器与客户端安装在同一物理网络上以便它可以接收DHCP DISCOVER数据包。您也可以将路由器配置为DHCP中继代理转发DHCP消息到其他网络。DHCP服务器收到DHCP DISCOVER数据包后响应DHCP OFFER数据包该数据包包含其自己的IP地址和客户端应使用的IP地址。该数据包还包括一个租用期限以指示所提供的IP地址有效的时间以及其他网络参数例如默认网关和DNS服务器。客户端收到DHCP服务器DHCP OFFER数据包后发送DHCP REQUEST广播数据包请求DHCP服务器提供的IP地址。这似乎很多余但是网络上可能有多个DHCP服务器或者路由器可能会将DHCP OFFER转发到多个网络。因此客户端可能会从不同的DHCP服务器收到响应。客户端的DHCP REQUEST数据包包括接受请求的DHCP服务器的IP地址。DHCP服务器收到DHCP REQUEST数据包后会发送DHCP ACK数据包确认客户端对客户端IP地址具有独占权限直到租约到期为止。思考为什么DHCP客户端收到Offer之后不直接使用该IP地址还需要发送一个Request告知服务器端广播的Request报文让网络中其他DHCP服务器端得知客户端已选择了某个服务器端分配的IP地址保证其他服务器端可以释放通过单播Offer分配给该客户端的IP地址。DHCP租期更新如果在 50% 租期时客户端未得到原服务器端的回应则客户端在 87.5% 租期时会广播发送DHCP Request任意一台DHCP服务器端都可回应该过程称为重绑定。租约到期后重新向DHCP服务器续约。DHCP服务器同意客户端续约。思考租期时长长还是短好分场景流动性大的场景火车站KTV酒吧超市租期设置短流动性小的场景办公室家庭设置长租期。在DHCP服务器上可以使用journalctl --unitdhcpd.service命令来访问客户端与服务器端通信消息。以下摘录显示了客户端通过DHCP请求IP地址。[rootdhcp-server ~]# journalctl --unit dhcpd.serviceAug 0115:49:43 dhcp-server dhcpd[1239]: DHCPDISCOVER from 00:0c:29:07:ec:8b via ens33 Aug 0115:49:44 dhcp-server dhcpd[1239]: DHCPOFFER on10.1.8.102 to 00:0c:29:07:ec:8b(dhcp-client1)via ens33 Aug 0115:49:44 dhcp-server dhcpd[1239]: DHCPREQUESTfor10.1.8.102(10.1.8.10)from 00:0c:29:07:ec:8b(dhcp-client1)via ens33 Aug 0115:49:44 dhcp-server dhcpd[1239]: DHCPACK on10.1.8.102 to 00:0c:29:07:ec:8b(dhcp-client1)via ens33 Aug 0115:49:45 dhcp-server dhcpd[1239]: DHCPDISCOVER from 00:0c:29:02:49:2a via ens33 Aug 0115:49:45 dhcp-server dhcpd[1239]: DHCPOFFER on10.1.8.88 to 00:0c:29:02:49:2a via ens33 Aug 0115:49:45 dhcp-server dhcpd[1239]: DHCPREQUESTfor10.1.8.88(10.1.8.10)from 00:0c:29:02:49:2a via ens33 Aug 0115:49:45 dhcp-server dhcpd[1239]: DHCPACK on10.1.8.88 to 00:0c:29:02:49:2a via ens33多DHCP服务器场景尽管DHCP支持在物理网络上运行多个DHCP服务器但不建议这么做。正常情况下同一个物理网络中只需要一台DHCP服务器应回答客户端的请求即可。在同一网络上运行多个服务器的情况下当新客户端发送DHCP DISCOVER数据包以获取地址时它可能会收到多个DHCP OFFER数据包。客户端仅接受其中一台服务器提供的配置并广播包含该服务器IP地址的DHCP REQUEST数据包。其他DHCP服务器释放它们为客户端准备的IP地址。但是当客户端使用DHCP REQUEST数据包更新其IP地址时服务器行为取决于服务器是否具有权威性。非权威的DHCP服务器会忽略DHCP REQUEST数据包中不知道的地址。当客户端发送的IP地址在权威DHCP服务器管理的地址范围内但服务器以前不知道该IP地址时它将拒绝该请求并发回DHCP NAK数据包。这可能意味着客户端最初是从网络上的另一台非权威的DHCP服务器获得其地址的。任何收到DHCP NAK数据包的客户端都不能再使用该地址而必须请求一个新的地址。使用默认配置启动DHCP服务器时服务器不是权威服务器这样可以防止非权威DHCP服务器接管权威服务器提供的地址。DHCP服务器搭建场景路由器、交换机Linux、Windows ServerTP-Link小米路由器家庭场景TP-Link小公司10人TP-Link中公司100-500人路由器交换机大公司1000Linux服务器查看DHCP服务日志示例[rootdhcp-server ~]# journalctl --unit dhcpd.serviceAug 0115:49:43 dhcp-server dhcpd[1239]: DHCPDISCOVER from 00:0c:29:07:ec:8b via ens33 Aug 0115:49:44 dhcp-server dhcpd[1239]: DHCPOFFER on10.1.8.102 to 00:0c:29:07:ec:8b(dhcp-client1)via ens33 Aug 0115:49:44 dhcp-server dhcpd[1239]: DHCPREQUESTfor10.1.8.102(10.1.8.10)from 00:0c:29:07:ec:8b(dhcp-client1)via ens33 Aug 0115:49:44 dhcp-server dhcpd[1239]: DHCPACK on10.1.8.102 to 00:0c:29:07:ec:8b(dhcp-client1)via ens33 Aug 0115:49:45 dhcp-server dhcpd[1239]: DHCPDISCOVER from 00:0c:29:02:49:2a via ens33 Aug 0115:49:45 dhcp-server dhcpd[1239]: DHCPOFFER on10.1.8.88 to 00:0c:29:02:49:2a via ens33 Aug 0115:49:45 dhcp-server dhcpd[1239]: DHCPREQUESTfor10.1.8.88(10.1.8.10)from 00:0c:29:02:49:2a via ens33 Aug 0115:49:45 dhcp-server dhcpd[1239]: DHCPACK on10.1.8.88 to 00:0c:29:02:49:2a via ens33路由器部署DHCP服务接口地址池路由器接口地址192.168.1.1/24属于192.168.1.0网段该网段成为能够分配的地址池接口地址自动成为分配的网关地址。第一步基础配置R1:Huaweisystem-view# 关闭消息提示[Huawei]undo info-centerenable[Huawei]sysname r1[r1]int e0/0/0[r1-Ethernet0/0/0]ipadd192.168.1.124[r1-Ethernet0/0/0]quitSW1:Huaweisystem-view[Huawei]sysname sw1# 关闭生成树[sw1]stp disable warning: The global STP state will be changed. Continue?[Y/N]y第二步配置路由器DHCPR1:[r1]dhcpenable# 全局使能dhcp功能[r1]int e0/0/0[r1-Ethernet0/0/0]dhcpselectinterface# 接口dhcp[r1-Ethernet0/0/0]dhcp server lease day3# dhcp租期3天[r1-Ethernet0/0/0]dhcp server dns-list223.5.5.5# DNS分配223.5.5.5阿里云公共DNS[r1-Ethernet0/0/0]dhcp server excluded-ip-address192.168.1.4# 地址池排除192.168.1.4第三步PC自动获取地址PC1:通过DHCP获取地址图形界面操作此处省略第四步抓包观察DHCP工作原理PC2: 抓包过程略动态的给PC3分配192.168.1.88记录PC3 MAC地址绑定通过display mac-address 查看R1r1system-view[r1]int e0/0/0[r1-Ethernet0/0/0]dhcp server static-bind ip-address192.168.1.88 mac-address5489-98f3-5b43#将192.168.1.88绑定到PC3 MACPC3全局地址池第一步基础配置R1:Huaweisystem-view[Huawei]undo info-centerenable[Huawei]sysname r1[r1]int e0/0/0[r1-Ethernet0/0/0]ipadd192.168.1.124[r1-Ethernet0/0/0]quitSW1:Huaweisystem-view[Huawei]sysname sw1[sw1]stp disable warning: The global STP state will be changed. Continue?[Y/N]y第二步配置路由器DHCP全局地址池R1:[Huawei]sysname r1[r1]int e0/0/0[r1-Ethernet0/0/0]ipadd192.168.1.124[r1-Ethernet0/0/0]quit[r1]ippool net1# 创建地址池[r1-ip-pool-net1]network192.168.1.0 mask24# 设置地址池范围[r1-ip-pool-net1]gateway-list192.168.1.1# 指定网关地址[r1-ip-pool-net1]dns-list223.5.5.5[r1-ip-pool-net1]lease day3hour12minute30[r1-ip-pool-net1]excluded-ip-address192.168.1.4[r1-ip-pool-net1]excluded-ip-address192.168.1.44[r1-ip-pool-net1]static-bind ip-address192.168.1.88 mac-address5489-98f3-5b43[r1-ip-pool-net1]quit[r1]dhcpenable[r1]int e0/0/0[r1-Ethernet0/0/0]dhcpselectglobal# 调用全局地址池第三步PC自动获取地址PC1:DHCP中继B楼的PC获取地址要将DHCP Discover报文发送到A楼的R1跨路由器由于DHCP Discover报文是广播所以发送不过去无法获取地址。配置DHCP中继R2将接收到的广播报文DHCP Discover转成单播发送给DHCP服务器R1从而获取地址。第一步基础配置R1:bashbashHuaweisystem-view[Huawei]undo info en[Huawei]sysname r1[r1]int e0/0/0[r1-Ethernet0/0/0]ipadd192.168.1.124[r1-Ethernet0/0/0]int e0/0/1[r1-Ethernet0/0/1]ipadd12.1.1.124[r1-Ethernet0/0/1]quit[r1]iproute-static192.168.2.02412.1.1.2R2:Huaweisystem-view[Huawei]undo info en[Huawei]sys r2[r2]int e0/0/0[r2-Ethernet0/0/0]ipadd192.168.2.124[r2-Ethernet0/0/0]int e0/0/1[r2-Ethernet0/0/1]ipadd12.1.1.224[r2-Ethernet0/0/1]quit[r2]iproute-static192.168.1.02412.1.1.1SW1:Huaweisystem-view[Huawei]undo info en[Huawei]sys sw1[sw1]stp disable warning: The global STP state will be changed. Continue?[Y/N]ySW2:Huaweisystem-view[Huawei]undo info en[Huawei]sys sw2[sw2]stp disable warning: The global STP state will be changed. Continue?[Y/N]y第二步配置路由器DHCPR1:# 创建地址池1[r1]ippool net1[r1-ip-pool-net1]network192.168.1.0 mask24[r1-ip-pool-net1]gateway-list192.168.1.1[r1-ip-pool-net1]dns-list8.8.8.8[r1-ip-pool-net1]quit# 创建地址池2[r1]ippool net2[r1-ip-pool-net2]network192.168.2.0 mask24[r1-ip-pool-net2]gateway-list192.168.2.1[r1-ip-pool-net2]dns-list114.114.114.114[r1-ip-pool-net2]quit# 全局使能dhcp功能[r1]dhcpenable# 接口调用全局地址池[r1]int e0/0/0[r1-Ethernet0/0/0]dhcpselectglobal[r1-Ethernet0/0/0]int e0/0/1第三步配置DHCP中继R2:[r2]dhcpenable[r2]int e0/0/0[r2-Ethernet0/0/0]dhcpselectrelay# 开启dhcp中继[r2-Ethernet0/0/0]dhcp relay server-ip12.1.1.1# 中继给12.1.1.1R1 DHCP服务器第四步PC自动获取地址抓包R2的E0/0/0和E0/0/1观察收到广播的DHCP Discover通过DHCP中继单播发给R1。DHCP中继服务器扩展-自学DHCP中继介绍前文介绍了DHCP客户端和DHCP服务器在同一个广播域中时的工作机制。如果DHCP客户端与DHCP服务器不处于同一个广播域那么DHCP客户端广播的DHCP Discover报文会被网络中的三层设备丢弃无法被DHCP服务器接收此时就需要DHCP中继代理DHCP Relay Agent。DHCP中继可以实现在不同广播域如子网、VLAN之间处理和转发DHCP工作时的广播报文使得DHCP客户端可以跨网段获取IP地址及相关参数。DHCP中继工作原理有DHCP中继的场景中DHCP中继在DHCP服务器和DHCP客户端之间转发DHCP报文以保证双方正常交互。客户端发送的报文会被同广播域内的DHCP中继收到然后由DHCP中继将DHCP报文以单播的形式转发给服务器。服务器响应的DHCP报文以单播形式发给DHCP中继再由中继转发给客户端。DHCP中继实践使用CentOS 7模板克隆出3台机器dhcp-server, dhcp-relay, dhcp-client。将dhcp-client机器的网卡改为vmnet1。给dhcp-relay添加第二块网卡(vmnet1)。配置3台服务器IP地址、主机名dhcp-server:[rootlocalhost ~]# hostnamectl set-hostname dhcp-server[rootlocalhost ~]# nmcli connection modify ens33 ipv4.method manual ipv4.address 10.1.8.10/24 ipv4.gateway 10.1.8.2 ipv4.dns 10.1.8.2 autoconnect yes[rootlocalhost ~]# nmcli connection up ens33dhcp-relay:[rootlocalhost ~]# hostnamectl set-hostname dhcp-relay[rootlocalhost ~]# nmcli connection modify ens33 ipv4.method manual ipv4.address 10.1.8.20/24 ipv4.gateway 10.1.8.2 ipv4.dns 10.1.8.2 autoconnect yes[rootlocalhost ~]# nmcli connection up ens33[rootlocalhost ~]# nmcli connection add ifname ens36 con-name ens36 type ethernet ipv4.method manual ipv4.address 10.1.1.20/24[rootlocalhost ~]# nmcli connection up ens36dhcp-client:[rootlocalhost ~]# hostnamectl set-hostname dhcp-client配置 dhcp-server# 安装软件包[rootdhcp-server ~]# yum install -y dhcp# 配置防火墙放行dhcp服务[rootdhcp-server ~]# firewall-cmd --add-servicedhcp[rootdhcp-server ~]# firewall-cmd --add-servicedhcp --permanent# 参考示例文件[rootdhcp-server ~]# vim /usr/share/doc/dhcp-*/dhcpd.conf.example# 编辑主配置文件[rootdhcp-server ~]# vim /etc/dhcp/dhcpd.conf在/etc/dhcp/dhcpd.conf中添加以下内容subnet10.1.8.0 netmask255.255.255.0{range10.1.8.10010.1.8.200;option routers10.1.8.20;option broadcast-address10.1.8.255;option domain-name-servers223.5.5.5;option domain-searchlaogao.cloud;default-lease-time600;max-lease-time7200;}# 新增一个地址池subnet10.1.1.0 netmask255.255.255.0{range10.1.1.10010.1.1.200;option routers10.1.1.20;option broadcast-address10.1.1.255;option domain-name-servers223.5.5.5;option domain-searchlaogao.cloud;default-lease-time600;max-lease-time7200;}启用并启动服务[rootdhcp-server ~]# systemctl enable dhcpd --now[rootdhcp-server ~]# systemctl status dhcpd配置路由DHCP server必须配置一条到达DHCP relay接收DHCP广播网卡的路由。# dhcp-server 去往 10.1.1.20/32 路由下一跳是 10.1.8.20[rootdhcp-server ~]# nmcli connection modify ens33 ipv4.routes 10.1.1.20/32 10.1.8.20[rootdhcp-server ~]# nmcli connection up ens33配置 dhcp-relay[rootdhcp-relay ~]# yum install -y dhcp[rootdhcp-relay ~]# cp /usr/lib/systemd/system/dhcrelay.service /etc/systemd/system/dhcrelay.service[rootdhcp-relay ~]# vim /etc/systemd/system/dhcrelay.service修改ExecStart行添加DHCP服务器IP地址[Unit] DescriptionDHCP Relay Agent Daemon Documentationman:dhcrelay(8) Wantsnetwork-online.target Afternetwork-online.target [Service] Typenotify ExecStart/usr/sbin/dhcrelay -d --no-pid 10.1.8.10 StandardErrornull [Install] WantedBymulti-user.target启动服务[rootdhcp-relay ~]# systemctl enable dhcrelay.service --now配置路由转发[rootdhcp-relay ~]# echo net.ipv4.ip_forward1 /etc/sysctl.conf[rootdhcp-relay ~]# sysctl -p /etc/sysctl.confnet.ipv4.ip_forward1客户端测试[rootdhcp-client ~]# nmcli connection add con-name dynamic type ethernet ipv4.method auto ifname ens33[rootdhcp-client ~]# nmcli connection up dynamic[rootdhcp-client ~]# ip -br a10UNKNOWN127.0.0.1/8 ::1/128 ens33 UP10.1.1.100/24 fe80::32c5:ad2b:c0d6:f3ab/64# 获取到地址验证确实是dhcp-server分配的[rootdhcp-server ~]# cat /var/lib/dhcpd/dhcpd.leases# The format of this file is documented in the dhcpd.leases(5) manual page.# This lease file was written by isc-dhcp-4.2.5server-duid\000\001\000\0012\004\\034\000\014)6\302w;lease10.1.1.100{starts22026/08/04 08:20:43;ends22026/08/04 08:30:43;cltt22026/08/04 08:20:43;binding state active;next binding statefree;rewind binding statefree;hardware ethernet 00:0c:29:d8:9d:e6;client-hostnamedhcp-client;}