<html><body><div style="font-family: Andale Mono; font-size: 10pt; color: #000000"><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">Folks,</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><br data-mce-bogus="1"></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">Is it not yet possible to allow/deny unkown clients in DHCPv6?</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><br data-mce-bogus="1"></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">In dhcpd for DHCPv4, it is possible to do something like this:</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;">---</div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">shared-network SomeNetwork {</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> subnet 10.0.0.0 netmask 255.255.255.0 {</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> pool {</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> range 10.0.0.2 10.0.0.254;</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> <span style="font-family: Menlo;" data-mce-style="font-family: Menlo;">deny unknown clients;</span></span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> }</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> }</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> subnet 10.160.0.0 netmask 255.255.255.0 {</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> pool {</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> range 10.160.0.2 10.160.0.254;</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> }</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"> }</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">}</span></div><div style="font-family: Andale Mono; font-size: 10pt; color: #000000;" data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><br data-mce-bogus="1"></div><div data-mce-style="font-family: Andale Mono; font-size: 10pt; color: #000000;"><p style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures; font-size: 10pt;" data-mce-style="font-variant-ligatures: no-common-ligatures; font-size: 10pt;">host SomeHost { hardware ethernet 00:01:02:03:04:05; }</span></p><p style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures; font-size: 10pt;" data-mce-style="font-variant-ligatures: no-common-ligatures; font-size: 10pt;">---</span></p><p style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures; font-size: 10pt;" data-mce-style="font-variant-ligatures: no-common-ligatures; font-size: 10pt;"><br data-mce-bogus="1"></span></p><p style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-variant-ligatures: no-common-ligatures; font-size: 10pt;" data-mce-style="font-variant-ligatures: no-common-ligatures; font-size: 10pt;">With the above config, the specified host of </span><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">00:</span><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">01</span><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">:</span><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">02</span><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">:03:04:05 would get an address out of the 10.0.0.0/24 range while a non-specified host of 00:10:20:30:40:50 would get an address out of 10.160.0.0/24</span></p><p style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><br data-mce-bogus="1"></span></p><p style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">Trying something similar in DHCPv6 (dhcpd -6) does not seem to produce the same behavior:</span></p><p style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;"><br data-mce-bogus="1"></span></p><p style="color: rgb(0, 0, 0); font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span style="font-size: 10pt;" data-mce-style="font-size: 10pt;">---</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;">shared-network FNGipv6Test {</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> subnet6 2001:0:50:e8::/64 {</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> range6 2001:0:50:e8::1 2001:0:50:e8:7fff:ffff:ffff:fffe;</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> prefix6 2001:0:58:: 2001:0:59:: /48;</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> min-lease-time 600;</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> preferred-lifetime 600;</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> default-lease-time 600;</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> max-lease-time 600;</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> deny unknown-clients;</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"> }</span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;"></span></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"></p><p style="margin: 0px; line-height: normal;" data-mce-style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo;"><span face="Menlo" data-mce-style="font-family: Menlo;" style="font-family: Menlo;">}</span></p><div style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;" data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;">---</div><div style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;" data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;"><br data-mce-bogus="1"></div><div style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;" data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;">with no hosts defined, everyone can get an address. The first thing I noticed was that using 'deny unknown clients;' produced a config error:</div><div style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;" data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;">---</div><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;"><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;">/etc/dhcpd6.conf line 9: expecting allow/deny key</div><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;"><span class="Apple-tab-span" style="white-space: pre;" data-mce-style="white-space: pre;"> </span>deny unknown </div><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;"> ^</div><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;">---</div><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;"><br data-mce-bogus="1"></div><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;">but did not produce an error when specified as 'deny unknown-clients;'. It did not, however, deny clients. All clients were able to get addresses and prefix delegations with no problems despite having no declarations in the config causing them to be 'known'.</div><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;"><br data-mce-bogus="1"></div><div data-mce-style="color: #000000; font-family: 'Andale Mono'; font-size: 10pt;"><br></div></div></div></div></body></html>