5.6 Services
The network services the appliance runs for the networks behind it: handing out addresses, answering names, distributing time, advertising IPv6, and scanning files.
Every service group ends with a Log File entry, and most have a Status page. When a service misbehaves, open its status page first and its log second — in that order, because the status page usually answers the question in one line.
DHCP: two backends, one at a time
The appliance can hand out addresses with Kea (the default) or with Dnsmasq, which does DNS and DHCP together. They do the same job; running both on the same network produces two servers answering one request, which is exactly as confusing as it sounds.
Take Kea unless you have a reason not to: it is what the interface editor configures when you switch on a DHCP server, and what the console's LAN setup uses. Take Dnsmasq when you want DHCP and DNS from one small service with per-host names, or on a very small appliance.
Kea DHCP
Kea DHCPv4 — /m/kea/dhcp4
Subnets and pools: for each network the appliance serves, the range it hands out, the router and DNS it announces, the lease time, and any reservations that pin a device to a fixed address by MAC.
Keep the pool clear of everything with a static address — the appliance itself, printers, switches. A pool that includes the router's own address is a fault the page will warn you about.
Kea DHCPv6 — /m/kea/dhcp6
The same for IPv6. Usually paired with Router Advertisements below: most IPv6 clients take their address from advertisements and only ask DHCPv6 for the extras.
Control Agent — /m/kea/ctrl_agent
The management channel the appliance uses to talk to the Kea daemons. Leave it alone unless you are integrating an external tool.
DDNS Agent — /m/kea/ddns
Registers leases into DNS, so a machine that just got an address is reachable by name.
Leases DHCPv4 / DHCPv6 — /leases/kea4, /leases/kea6
Who holds which address, since when, and until when. The first page to open when someone says "my machine has no network": either they have a lease, in which case the problem is elsewhere, or they do not, in which case it is here.
Log File — /log/core/kea
Dnsmasq DNS & DHCP
A single small service that answers DNS and hands out addresses. Its pages follow its configuration:
| Page | For |
|---|---|
General — #general | Whether it runs, which interfaces it listens on, and its DNS behaviour. |
Domains — #domains | Domain overrides: send one domain to a different resolver. |
Hosts — #hosts | Static name-to-address entries. |
DHCP ranges — #dhcpranges | The pools it hands out. |
DHCP options — #dhcpoptions | Extra options for clients (NTP servers, boot parameters, vendor options). |
DHCP boot — #dhcpboot | Network boot: the TFTP server and boot file for PXE clients. |
DHCP tags — #dhcptags | Tags that let one range or option apply to a subset of clients. |
Leases — /leases/dnsmasq | Current leases. |
Unbound DNS
The recursive resolver the appliance offers to its networks. It is on by default and is what clients use unless you point them elsewhere.
General — /m/unbound/unboundplus
Whether the resolver runs, which interfaces it answers on, whether it validates DNSSEC, and whether it registers DHCP leases so local machines resolve by name.
Port 53 can only be held by one service. If Unbound refuses to start, check whether Dnsmasq is also configured to answer DNS on the same interface.
Overrides — ?a=hosts/host,aliases/alias
Host overrides (a name that answers with an address you choose) and aliases. This is how you make an internal service answer with its internal address while the public DNS points elsewhere.
Access Lists — ?a=acls/acl
Which networks may query the resolver. An open resolver reachable from the internet will be abused; keep this to your own networks.
Blocklists — ?a=dnsbl/blocklist
DNS-level blocking from subscribed lists — advertising, tracking, malware domains — with your own allow and block entries on top. Cheap, effective, and invisible to clients.
Query Forwarding / DNS over TLS
Forwarding sends queries to chosen upstream resolvers instead of resolving from the root. DNS over TLS does the same over an encrypted channel, so the upstream provider is the only party that sees your queries.
Advanced — /m/unbound/unboundplus
Cache sizes, thread counts, prefetching and the rest. Defaults are sane for an appliance; raise the cache before anything else if the resolver is busy.
Statistics — /unbound-stats
Queries answered, cache hit rate, what was blocked. A low hit rate on a busy network is the sign that the cache is too small.
Log File — /log/core/resolver
DHCRelay — /m/dhcrelay/dhcrelay
Forwards DHCP requests from a network with no local server to a server somewhere else — the usual arrangement when a central server owns all addressing. Configure the interface to listen on and the server to relay to.
Router Advertisements — /m/radvd/radvd
How the appliance announces itself as an IPv6 router: the mode (unmanaged, managed, assisted), the prefixes it advertises, and the DNS it hands out. Without this, IPv6 clients on the segment get no address at all.
Network Time
General — /system-ntp
The time service: which servers the appliance follows, and whether it serves time to the networks behind it.
Time matters more than it looks. Certificate validation, VPN negotiation, logging and compliance records all depend on the clock being right.
GPS / PPS — #gps, #pps
For appliances with a GPS receiver or a pulse-per-second input: a local reference clock, for sites that cannot depend on the internet for time.
Status — /ntp-status
The peer table: which server is actually selected, the offset, and the jitter. "Synchronised" is a state you can read here, not an assumption.
Log File — /log/core/ntpd
ClamAV Antivirus
Settings — /m/clamav/clamav
The virus scanner: whether it runs, how often signatures refresh, and the scan limits.
ClamAV holds its signature database in memory — about a gigabyte. On an appliance with 2 GB of RAM, enabling it changes the machine's character. Budget 4 GB or more if you want it on.
Status — /clamav-status
Whether the scanner is up, how old the signatures are, and what the last update did. An old signature date is the thing to notice here.
Log File — /log/core/clamav
