<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 4/30/20 1:57 AM, Ben Monroe wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAD+EcOA0L6_Fn9yZ3YZYO2pEj6a_22QNtTchWH+Bbbir-e_SHQ@mail.gmail.com">
<div dir="ltr">
<div>I may be wrong, but I would expect that listening on
127.0.0.1 should work as it is the server itself.</div>
</div>
</blockquote>
<br>
I have more experience with LXD containers then docker containers so
I could be wrong here, but I would assume that each container has
its own network namespace therefore D2's containers' loopback is not
the same as DHCP4's containers' loopback (and both would be
different then the host's loopback). In either case you would have
to send requests to loopback in order for that to work and you are
sending them to a global address. The IP addresses must match
between the two configurations. See the note below the warning in
the documentation link you posted.<br>
<br>
Perhaps someone with more knowledge about docker knows if it is
possible to expose the loopback address from one container to
another or share the host's. I would assume there are security
concerns if this is true.<br>
<br>
<blockquote type="cite"
cite="mid:CAD+EcOA0L6_Fn9yZ3YZYO2pEj6a_22QNtTchWH+Bbbir-e_SHQ@mail.gmail.com">
<div dir="ltr">
<div>In fact, the documentation includes a warning for any other
configuration:</div>
<div><a
href="https://kea.readthedocs.io/en/kea-1.6.1/arm/ddns.html#global-server-parameters"
moz-do-not-send="true">https://kea.readthedocs.io/en/kea-1.6.1/arm/ddns.html#global-server-parameters</a></div>
</div>
</blockquote>
<br>
Yes it is a security concern to run D2 on a global address. What
this means is that it is recommended to always run it on the same
machine (in your case container) as the DHCP4 and/or DHCP6
server(s). Again there may be some neat way in docker to avoid all
this, but if not just make sure you secure that address as much as
possible to avoid spoofed DNS change requests.<br>
<br>
<blockquote type="cite"
cite="mid:CAD+EcOA0L6_Fn9yZ3YZYO2pEj6a_22QNtTchWH+Bbbir-e_SHQ@mail.gmail.com">
<div dir="ltr">
<div>Following your suggesting I installed ss (iproute2). Oddly
enough, it does not seem to be listening to any ports.</div>
<div>root@
a987aac4aa8b:/# ss<br>
Netid State Recv-Q Send-Q
Local Address:Port
Peer Address:Port<br>
</div>
</div>
</blockquote>
<br>
Does running `<font face="Droid Sans Mono">ss -tupnl | grep 53001</font>`
return anything? If not try that command on the docker host. It's
unclear if you actually tested a change request after restarting D2?
Can you try submitting one. You can also sniff the wire again to see
if traffic is being received this time.<br>
<pre class="moz-signature" cols="0">--
Thanks,
Joshua Schaeffer</pre>
</body>
</html>