#dhcp — Public Fediverse posts

How does #Fortinet put out network management routers that have quality of life features formerly exclusive to consumer and handrolled devices like SOHO #routers and what you could build with an old computer by reading the Linux HOWTO Project documents like #DHCP and #DNS, yet, beyond all possible comprehension, not dynamically update DNS and rDNS based on static assignments and the DHCP lease table?

How does #Fortinet put out network management routers that have quality of life features formerly exclusive to consumer and handrolled devices like SOHO #routers and what you could build with an old computer by reading the Linux HOWTO Project documents like #DHCP and #DNS, yet, beyond all possible comprehension, not dynamically update DNS and rDNS based on static assignments and the DHCP lease table?

How does #Fortinet put out network management routers that have quality of life features formerly exclusive to consumer and handrolled devices like SOHO #routers and what you could build with an old computer by reading the Linux HOWTO Project documents like #DHCP and #DNS, yet, beyond all possible comprehension, not dynamically update DNS and rDNS based on static assignments and the DHCP lease table?

How does #Fortinet put out network management routers that have quality of life features formerly exclusive to consumer and handrolled devices like SOHO #routers and what you could build with an old computer by reading the Linux HOWTO Project documents like #DHCP and #DNS, yet, beyond all possible comprehension, not dynamically update DNS and rDNS based on static assignments and the DHCP lease table?

How does #Fortinet put out network management routers that have quality of life features formerly exclusive to consumer and handrolled devices like SOHO #routers and what you could build with an old computer by reading the Linux HOWTO Project documents like #DHCP and #DNS, yet, beyond all possible comprehension, not dynamically update DNS and rDNS based on static assignments and the DHCP lease table?

DHCP is the network receptionist 🏷️💻

New device joins?
DHCP hands out the IP address, gateway, DNS settings, and lease time.

The new Networking for Humans post explains automatic network configuration without acronym pain.

#Networking #DHCP #ELI5 #ITTraining #DevOps

https://webdad.eu/2026/07/16/%f0%9f%8f%b7%ef%b8%8f-dhcp-is-the-receptionist-who-hands-out-name-tags/

Le madonne per la rete
Quando Eolo cambia il router

Solo Linux non li vede
Questi vecchi due repeater

Con il fritzbox tutto bene
Ma epicentro non dà speme!

(Sull'aria del ritornello di AL MIO PAESE di Brancale, Levante e Delia)

#sfogo #rant #network #wifiExtender #router #eolo #epicentro #dhcp

Le madonne per la rete
Quando Eolo cambia il router

Solo Linux non li vede
Questi vecchi due repeater

Con il fritzbox tutto bene
Ma epicentro non dà speme!

(Sull'aria del ritornello di AL MIO PAESE di Brancale, Levante e Delia)

#sfogo #rant #network #wifiExtender #router #eolo #epicentro #dhcp

Le madonne per la rete
Quando Eolo cambia il router

Solo Linux non li vede
Questi vecchi due repeater

Con il fritzbox tutto bene
Ma epicentro non dà speme!

(Sull'aria del ritornello di AL MIO PAESE di Brancale, Levante e Delia)

#sfogo #rant #network #wifiExtender #router #eolo #epicentro #dhcp

Le madonne per la rete
Quando Eolo cambia il router

Solo Linux non li vede
Questi vecchi due repeater

Con il fritzbox tutto bene
Ma epicentro non dà speme!

(Sull'aria del ritornello di AL MIO PAESE di Brancale, Levante e Delia)

#sfogo #rant #network #wifiExtender #router #eolo #epicentro #dhcp

Le madonne per la rete
Quando Eolo cambia il router

Solo Linux non li vede
Questi vecchi due repeater

Con il fritzbox tutto bene
Ma epicentro non dà speme!

(Sull'aria del ritornello di AL MIO PAESE di Brancale, Levante e Delia)

#sfogo #rant #network #wifiExtender #router #eolo #epicentro #dhcp

apparently i cant set per host next-server values in opnsense which is crazy since its supposed to be superior to pfsense

#opnsense #pfsense #router #networking #dhcp

i hate that opnsense comes with multiple options for dhcp and dns by default so everytime i have to change something im just left there guessing which one is actually being used and it doesnt help that opnsense ui is slow af

#opnsense #networking #router #dhcp #dns

🐀 Cybersecurity Advance Class

👿 Rogue DHCP Server

Quando un client entra in rete, accetta spesso la prima risposta DHCP ricevuta. Un server DHCP non autorizzato può assegnare gateway e DNS malevoli, intercettando il traffico e aprendo la strada a phishing, MITM e furto di credenziali.

@sicurezza

#CyberSecurity #InfoSec #Networking #DHCP #Nextred

🐀 Cybersecurity Advance Class

👿 Rogue DHCP Server

Quando un client entra in rete, accetta spesso la prima risposta DHCP ricevuta. Un server DHCP non autorizzato può assegnare gateway e DNS malevoli, intercettando il traffico e aprendo la strada a phishing, MITM e furto di credenziali.

@sicurezza

#CyberSecurity #InfoSec #Networking #DHCP #Nextred

🐀 Cybersecurity Advance Class

👿 Rogue DHCP Server

Quando un client entra in rete, accetta spesso la prima risposta DHCP ricevuta. Un server DHCP non autorizzato può assegnare gateway e DNS malevoli, intercettando il traffico e aprendo la strada a phishing, MITM e furto di credenziali.

@sicurezza

#CyberSecurity #InfoSec #Networking #DHCP #Nextred

🐀 Cybersecurity Advance Class

👿 Rogue DHCP Server

Quando un client entra in rete, accetta spesso la prima risposta DHCP ricevuta. Un server DHCP non autorizzato può assegnare gateway e DNS malevoli, intercettando il traffico e aprendo la strada a phishing, MITM e furto di credenziali.

@sicurezza

#CyberSecurity #InfoSec #Networking #DHCP #Nextred

🐀 Cybersecurity Advance Class

👿 Rogue DHCP Server

Quando un client entra in rete, accetta spesso la prima risposta DHCP ricevuta. Un server DHCP non autorizzato può assegnare gateway e DNS malevoli, intercettando il traffico e aprendo la strada a phishing, MITM e furto di credenziali.

@sicurezza

#CyberSecurity #InfoSec #Networking #DHCP #Nextred

@rabautz ich habe erst mit #dnsmasq angefangen, wurde aber nicht warm damit. Bei weiterer Recherche kam ich auf #KeaDHCP und ich weis nicht wo ich es gelesen habe aber es wurde als neuer #DHCP Server gefeiert. Und mit Kea bin ich sehr gut klar gekommen und dabei geblieben.

#OPNsense

@rabautz ich habe erst mit #dnsmasq angefangen, wurde aber nicht warm damit. Bei weiterer Recherche kam ich auf #KeaDHCP und ich weis nicht wo ich es gelesen habe aber es wurde als neuer #DHCP Server gefeiert. Und mit Kea bin ich sehr gut klar gekommen und dabei geblieben.

#OPNsense

@rabautz ich habe erst mit #dnsmasq angefangen, wurde aber nicht warm damit. Bei weiterer Recherche kam ich auf #KeaDHCP und ich weis nicht wo ich es gelesen habe aber es wurde als neuer #DHCP Server gefeiert. Und mit Kea bin ich sehr gut klar gekommen und dabei geblieben.

#OPNsense

The #DHCP server, running on the #OpenWRT router, assigned an internal IP to a client. However this IP was already used by a central NAS device. This situation is called an IP address conflict.

In our latest #tutorial we show where to find the current DHCP leases, how to create a static and remove an existing lease on @openwrt .

https://www.geekersdigest.com/how-to-manually-remove-a-dhcp-lease-on-openwrt-router/

The #DHCP server, running on the #OpenWRT router, assigned an internal IP to a client. However this IP was already used by a central NAS device. This situation is called an IP address conflict.

In our latest #tutorial we show where to find the current DHCP leases, how to create a static and remove an existing lease on @openwrt .

https://www.geekersdigest.com/how-to-manually-remove-a-dhcp-lease-on-openwrt-router/

The #DHCP server, running on the #OpenWRT router, assigned an internal IP to a client. However this IP was already used by a central NAS device. This situation is called an IP address conflict.

In our latest #tutorial we show where to find the current DHCP leases, how to create a static and remove an existing lease on @openwrt .

https://www.geekersdigest.com/how-to-manually-remove-a-dhcp-lease-on-openwrt-router/

The #DHCP server, running on the #OpenWRT router, assigned an internal IP to a client. However this IP was already used by a central NAS device. This situation is called an IP address conflict.

In our latest #tutorial we show where to find the current DHCP leases, how to create a static and remove an existing lease on @openwrt .

https://www.geekersdigest.com/how-to-manually-remove-a-dhcp-lease-on-openwrt-router/

The #DHCP server, running on the #OpenWRT router, assigned an internal IP to a client. However this IP was already used by a central NAS device. This situation is called an IP address conflict.

In our latest #tutorial we show where to find the current DHCP leases, how to create a static and remove an existing lease on @openwrt .

https://www.geekersdigest.com/how-to-manually-remove-a-dhcp-lease-on-openwrt-router/

OMG, i thought things were supposed to get simpler as newer versions of software came out.

On the "Legacy" ISC #DHCP settings in #OPNSense, you could just type an IP address into the NTP text box.

In the "improved" version, which uses Kea DHCP instead, it will only accept "hex".

I assume this is just the #IPv6 address with no ":"s and loads of "0000"s (in my case), but some guidance would be helpful.... or just a fucking text box specifically for a IP address like the "legacy" version <sigh>.

OMG, i thought things were supposed to get simpler as newer versions of software came out.

On the "Legacy" ISC #DHCP settings in #OPNSense, you could just type an IP address into the NTP text box.

In the "improved" version, which uses Kea DHCP instead, it will only accept "hex".

I assume this is just the #IPv6 address with no ":"s and loads of "0000"s (in my case), but some guidance would be helpful.... or just a fucking text box specifically for a IP address like the "legacy" version <sigh>.

OMG, i thought things were supposed to get simpler as newer versions of software came out.

On the "Legacy" ISC #DHCP settings in #OPNSense, you could just type an IP address into the NTP text box.

In the "improved" version, which uses Kea DHCP instead, it will only accept "hex".

I assume this is just the #IPv6 address with no ":"s and loads of "0000"s (in my case), but some guidance would be helpful.... or just a fucking text box specifically for a IP address like the "legacy" version <sigh>.

OMG, i thought things were supposed to get simpler as newer versions of software came out.

On the "Legacy" ISC #DHCP settings in #OPNSense, you could just type an IP address into the NTP text box.

In the "improved" version, which uses Kea DHCP instead, it will only accept "hex".

I assume this is just the #IPv6 address with no ":"s and loads of "0000"s (in my case), but some guidance would be helpful.... or just a fucking text box specifically for a IP address like the "legacy" version <sigh>.

OMG, i thought things were supposed to get simpler as newer versions of software came out.

On the "Legacy" ISC #DHCP settings in #OPNSense, you could just type an IP address into the NTP text box.

In the "improved" version, which uses Kea DHCP instead, it will only accept "hex".

I assume this is just the #IPv6 address with no ":"s and loads of "0000"s (in my case), but some guidance would be helpful.... or just a fucking text box specifically for a IP address like the "legacy" version <sigh>.

#Kea 3.1.9 (dev) has been released ( #DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium ) https://www.isc.org/kea/

#Kea 3.1.9 (dev) has been released ( #DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium ) https://www.isc.org/kea/

#Kea 3.1.9 (dev) has been released ( #DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium ) https://www.isc.org/kea/

#Kea 3.1.9 (dev) has been released ( #DHCP / #DHCPv4 / #DHCPv6 / #DNS / #ISC / #InternetSystemsConsortium ) https://www.isc.org/kea/

#DHCP, #DNS, #IPv6, #TLS: Ihr seid anstrengend.

#pihole ignoriert nach Update standardmäßig die eigene dnsmasq-Konfiguration. Alle Hosts bekommen zwei IPv6-Gateways: Router und Pi-hole. Ziemlich zufällig wirkend hängen dann Verbindungen.

#Docker Compose-Setup mit #Coolify: Anfragen wechseln zwischen den Umgebungen, weil es kein Docker-Netz pro Umgebung gibt und per DNS-Round-Robin Anfragen zufällig an Apps verteilt werden.

#Traefik aktualisiert Zertifikate auf Basis von 2160 Stunden Gültigkeit (änderbar mit acme.certificatesDuration). #step-ca gibt Zertifikate aus, die 24 Stunden gültig sind (änderbar über authority.claims.{max,default}TLSCertDuration). Kein Wunder, dass das ganze Setup einen Tag später nicht mehr läuft.

Usw. usf.

#DHCP, #DNS, #IPv6, #TLS: Ihr seid anstrengend.

#pihole ignoriert nach Update standardmäßig die eigene dnsmasq-Konfiguration. Alle Hosts bekommen zwei IPv6-Gateways: Router und Pi-hole. Ziemlich zufällig wirkend hängen dann Verbindungen.

#Docker Compose-Setup mit #Coolify: Anfragen wechseln zwischen den Umgebungen, weil es kein Docker-Netz pro Umgebung gibt und per DNS-Round-Robin Anfragen zufällig an Apps verteilt werden.

#Traefik aktualisiert Zertifikate auf Basis von 2160 Stunden Gültigkeit (änderbar mit acme.certificatesDuration). #step-ca gibt Zertifikate aus, die 24 Stunden gültig sind (änderbar über authority.claims.{max,default}TLSCertDuration). Kein Wunder, dass das ganze Setup einen Tag später nicht mehr läuft.

Usw. usf.

Mood : https://www.youtube.com/shorts/o56qL2t4swA

Doing network booting (#DHCP, #TFTP, #iPXE, #UEFI, #SecureBoot)
I haven't reached the “Oh, that's why” so far. But very annoyed

https://ipxe.org/secboot
“The Secure Boot shim (e.g. ipxe-shim.efi or snponly-shim.efi) will automatically load the iPXE binary with the corresponding name (e.g. ipxe.efi or snponly.efi).”
Definitely not what's happening…
So It kept loading the wrong iPXE firmware (not the snmponly) and I kept wondering why my keyboard wasn't working :<

Mood : https://www.youtube.com/shorts/o56qL2t4swA

Doing network booting (#DHCP, #TFTP, #iPXE, #UEFI, #SecureBoot)
I haven't reached the “Oh, that's why” so far. But very annoyed

https://ipxe.org/secboot
“The Secure Boot shim (e.g. ipxe-shim.efi or snponly-shim.efi) will automatically load the iPXE binary with the corresponding name (e.g. ipxe.efi or snponly.efi).”
Definitely not what's happening…
So It kept loading the wrong iPXE firmware (not the snmponly) and I kept wondering why my keyboard wasn't working :<

Mood : https://www.youtube.com/shorts/o56qL2t4swA

Doing network booting (#DHCP, #TFTP, #iPXE, #UEFI, #SecureBoot)
I haven't reached the “Oh, that's why” so far. But very annoyed

https://ipxe.org/secboot
“The Secure Boot shim (e.g. ipxe-shim.efi or snponly-shim.efi) will automatically load the iPXE binary with the corresponding name (e.g. ipxe.efi or snponly.efi).”
Definitely not what's happening…
So It kept loading the wrong iPXE firmware (not the snmponly) and I kept wondering why my keyboard wasn't working :<

Mood : https://www.youtube.com/shorts/o56qL2t4swA

Doing network booting (#DHCP, #TFTP, #iPXE, #UEFI, #SecureBoot)
I haven't reached the “Oh, that's why” so far. But very annoyed

https://ipxe.org/secboot
“The Secure Boot shim (e.g. ipxe-shim.efi or snponly-shim.efi) will automatically load the iPXE binary with the corresponding name (e.g. ipxe.efi or snponly.efi).”
Definitely not what's happening…
So It kept loading the wrong iPXE firmware (not the snmponly) and I kept wondering why my keyboard wasn't working :<

When two Hetzner servers died at the same time

On May 12, 2026, two of my Arch Linux + LUKS servers at Hetzner became unreachable at the same moment. Both had been running for 4+ months without issue. Both had received the same pacman -Syyu the day before, but had stayed on the old kernel until the morning the websites stopped responding. I rebooted — SSH never came back. nmap -Pn -p 22 showed filtered from anywhere. No ping. No banner. The Hetzner Robot panel insisted the hardware was fine.

Several hours went into hypotheses that turned out to be wrong:

• The encryptssh initcpio hook referencing a /usr/lib/initcpio/udev/11-dm-initramfs.rules file that no longer exists. Real bug, no boot impact — the initramfs rebuilds anyway.
• PermitRootLogin no in sshd_config. Real misconfiguration, fixed it, didn’t help. A refusing sshd shows closed, not filtered.
• Predictable interface-naming drift after the systemd 260 upgrade. Patched the .network config to match by MAC. Useful hardening; not the cause.
• Stale GRUB stage1 + core.img in the MBR. Arch never re-runs grub-install after a grub package upgrade. Refreshed it. Still filtered.
• Kernel 7.0.5 regression. Downgraded to 6.18.3, the kernel that had run for 4 months. Still filtered. So the kernel itself wasn’t it either.

The clue was in the persistent journal: a single recorded boot from December 31 to May 12 10:13 UTC, and absolutely nothing after. Every reboot since the upgrade was failing before systemd-journald could flush to disk — so the failure had to be in the initramfs, before the root filesystem was even mounted.

What it almost certainly was

Hetzner Dedicated servers configure the initramfs network with ip=dhcp on the kernel command line. That depends on Hetzner’s DHCP server replying to whatever request format the current kernel sends. Somewhere between kernel 6.18 / iproute2 6.18 and kernel 7.0 / iproute2 7.0, the request format changed enough that Hetzner’s DHCP stopped responding. Effects:

• Old kernel at runtime kept the interface already configured (Phase A — 32 hours of healthy operation after the package upgrade).
• New kernel cold-boots, hits DHCP, never gets an IP, dropbear cannot listen, port 22 stays filtered.

Hetzner’s own documentation has been quietly moving away from ip=dhcp toward static IPv4 in the kernel command line. The fix is exactly that:

GRUB_CMDLINE_LINUX="cryptdevice=/dev/md1:cryptroot ip=A.B.C.D::GATEWAY:255.255.255.255:hostname:eth0:none"

One line in /etc/default/grub, grub-mkconfig, reboot. No more dependency on Hetzner’s DHCP responding to whatever your current kernel sends.

Why it matters for anyone running this stack

If you run Arch on Hetzner Dedicated with full-disk encryption and remote unlock via dropbear, the ip=dhcp shipped by installimage is a latent bug. It can keep working for years and then break overnight, on every machine you have, after a routine pacman -Syyu. The static-IP version is what Hetzner now recommends and removes the entire dependency.

Tooling

While debugging, I turned the whole rescue / chroot / diagnose / fix workflow into a Python CLI (hal) — including hal fix static-ip, which derives the static cmdline directly from your existing systemd-networkd .network file:

→ github.com/kevinveenbirkenbach/hetzner-arch-luks

Single command, idempotent, reversible (the original /etc/default/grub is backed up to .hal-backup). If you’re on this stack, switch to static IP before the next kernel upgrade catches you.

When two Hetzner servers died at the same time

On May 12, 2026, two of my Arch Linux + LUKS servers at Hetzner became unreachable at the same moment. Both had been running for 4+ months without issue. Both had received the same pacman -Syyu the day before, but had stayed on the old kernel until the morning the websites stopped responding. I rebooted — SSH never came back. nmap -Pn -p 22 showed filtered from anywhere. No ping. No banner. The Hetzner Robot panel insisted the hardware was fine.

Several hours went into hypotheses that turned out to be wrong:

• The encryptssh initcpio hook referencing a /usr/lib/initcpio/udev/11-dm-initramfs.rules file that no longer exists. Real bug, no boot impact — the initramfs rebuilds anyway.
• PermitRootLogin no in sshd_config. Real misconfiguration, fixed it, didn’t help. A refusing sshd shows closed, not filtered.
• Predictable interface-naming drift after the systemd 260 upgrade. Patched the .network config to match by MAC. Useful hardening; not the cause.
• Stale GRUB stage1 + core.img in the MBR. Arch never re-runs grub-install after a grub package upgrade. Refreshed it. Still filtered.
• Kernel 7.0.5 regression. Downgraded to 6.18.3, the kernel that had run for 4 months. Still filtered. So the kernel itself wasn’t it either.

The clue was in the persistent journal: a single recorded boot from December 31 to May 12 10:13 UTC, and absolutely nothing after. Every reboot since the upgrade was failing before systemd-journald could flush to disk — so the failure had to be in the initramfs, before the root filesystem was even mounted.

What it almost certainly was

Hetzner Dedicated servers configure the initramfs network with ip=dhcp on the kernel command line. That depends on Hetzner’s DHCP server replying to whatever request format the current kernel sends. Somewhere between kernel 6.18 / iproute2 6.18 and kernel 7.0 / iproute2 7.0, the request format changed enough that Hetzner’s DHCP stopped responding. Effects:

• Old kernel at runtime kept the interface already configured (Phase A — 32 hours of healthy operation after the package upgrade).
• New kernel cold-boots, hits DHCP, never gets an IP, dropbear cannot listen, port 22 stays filtered.

Hetzner’s own documentation has been quietly moving away from ip=dhcp toward static IPv4 in the kernel command line. The fix is exactly that:

GRUB_CMDLINE_LINUX="cryptdevice=/dev/md1:cryptroot ip=A.B.C.D::GATEWAY:255.255.255.255:hostname:eth0:none"

One line in /etc/default/grub, grub-mkconfig, reboot. No more dependency on Hetzner’s DHCP responding to whatever your current kernel sends.

Why it matters for anyone running this stack

If you run Arch on Hetzner Dedicated with full-disk encryption and remote unlock via dropbear, the ip=dhcp shipped by installimage is a latent bug. It can keep working for years and then break overnight, on every machine you have, after a routine pacman -Syyu. The static-IP version is what Hetzner now recommends and removes the entire dependency.

Tooling

While debugging, I turned the whole rescue / chroot / diagnose / fix workflow into a Python CLI (hal) — including hal fix static-ip, which derives the static cmdline directly from your existing systemd-networkd .network file:

→ github.com/kevinveenbirkenbach/hetzner-arch-luks

Single command, idempotent, reversible (the original /etc/default/grub is backed up to .hal-backup). If you’re on this stack, switch to static IP before the next kernel upgrade catches you.

When two Hetzner servers died at the same time

On May 12, 2026, two of my Arch Linux + LUKS servers at Hetzner became unreachable at the same moment. Both had been running for 4+ months without issue. Both had received the same pacman -Syyu the day before, but had stayed on the old kernel until the morning the websites stopped responding. I rebooted — SSH never came back. nmap -Pn -p 22 showed filtered from anywhere. No ping. No banner. The Hetzner Robot panel insisted the hardware was fine.

Several hours went into hypotheses that turned out to be wrong:

• The encryptssh initcpio hook referencing a /usr/lib/initcpio/udev/11-dm-initramfs.rules file that no longer exists. Real bug, no boot impact — the initramfs rebuilds anyway.
• PermitRootLogin no in sshd_config. Real misconfiguration, fixed it, didn’t help. A refusing sshd shows closed, not filtered.
• Predictable interface-naming drift after the systemd 260 upgrade. Patched the .network config to match by MAC. Useful hardening; not the cause.
• Stale GRUB stage1 + core.img in the MBR. Arch never re-runs grub-install after a grub package upgrade. Refreshed it. Still filtered.
• Kernel 7.0.5 regression. Downgraded to 6.18.3, the kernel that had run for 4 months. Still filtered. So the kernel itself wasn’t it either.

The clue was in the persistent journal: a single recorded boot from December 31 to May 12 10:13 UTC, and absolutely nothing after. Every reboot since the upgrade was failing before systemd-journald could flush to disk — so the failure had to be in the initramfs, before the root filesystem was even mounted.

What it almost certainly was

Hetzner Dedicated servers configure the initramfs network with ip=dhcp on the kernel command line. That depends on Hetzner’s DHCP server replying to whatever request format the current kernel sends. Somewhere between kernel 6.18 / iproute2 6.18 and kernel 7.0 / iproute2 7.0, the request format changed enough that Hetzner’s DHCP stopped responding. Effects:

• Old kernel at runtime kept the interface already configured (Phase A — 32 hours of healthy operation after the package upgrade).
• New kernel cold-boots, hits DHCP, never gets an IP, dropbear cannot listen, port 22 stays filtered.

Hetzner’s own documentation has been quietly moving away from ip=dhcp toward static IPv4 in the kernel command line. The fix is exactly that:

GRUB_CMDLINE_LINUX="cryptdevice=/dev/md1:cryptroot ip=A.B.C.D::GATEWAY:255.255.255.255:hostname:eth0:none"

One line in /etc/default/grub, grub-mkconfig, reboot. No more dependency on Hetzner’s DHCP responding to whatever your current kernel sends.

Why it matters for anyone running this stack

If you run Arch on Hetzner Dedicated with full-disk encryption and remote unlock via dropbear, the ip=dhcp shipped by installimage is a latent bug. It can keep working for years and then break overnight, on every machine you have, after a routine pacman -Syyu. The static-IP version is what Hetzner now recommends and removes the entire dependency.

Tooling

While debugging, I turned the whole rescue / chroot / diagnose / fix workflow into a Python CLI (hal) — including hal fix static-ip, which derives the static cmdline directly from your existing systemd-networkd .network file:

→ github.com/kevinveenbirkenbach/hetzner-arch-luks

Single command, idempotent, reversible (the original /etc/default/grub is backed up to .hal-backup). If you’re on this stack, switch to static IP before the next kernel upgrade catches you.

When two Hetzner servers died at the same time

On May 12, 2026, two of my Arch Linux + LUKS servers at Hetzner became unreachable at the same moment. Both had been running for 4+ months without issue. Both had received the same pacman -Syyu the day before, but had stayed on the old kernel until the morning the websites stopped responding. I rebooted — SSH never came back. nmap -Pn -p 22 showed filtered from anywhere. No ping. No banner. The Hetzner Robot panel insisted the hardware was fine.

Several hours went into hypotheses that turned out to be wrong:

• The encryptssh initcpio hook referencing a /usr/lib/initcpio/udev/11-dm-initramfs.rules file that no longer exists. Real bug, no boot impact — the initramfs rebuilds anyway.
• PermitRootLogin no in sshd_config. Real misconfiguration, fixed it, didn’t help. A refusing sshd shows closed, not filtered.
• Predictable interface-naming drift after the systemd 260 upgrade. Patched the .network config to match by MAC. Useful hardening; not the cause.
• Stale GRUB stage1 + core.img in the MBR. Arch never re-runs grub-install after a grub package upgrade. Refreshed it. Still filtered.
• Kernel 7.0.5 regression. Downgraded to 6.18.3, the kernel that had run for 4 months. Still filtered. So the kernel itself wasn’t it either.

The clue was in the persistent journal: a single recorded boot from December 31 to May 12 10:13 UTC, and absolutely nothing after. Every reboot since the upgrade was failing before systemd-journald could flush to disk — so the failure had to be in the initramfs, before the root filesystem was even mounted.

What it almost certainly was

Hetzner Dedicated servers configure the initramfs network with ip=dhcp on the kernel command line. That depends on Hetzner’s DHCP server replying to whatever request format the current kernel sends. Somewhere between kernel 6.18 / iproute2 6.18 and kernel 7.0 / iproute2 7.0, the request format changed enough that Hetzner’s DHCP stopped responding. Effects:

• Old kernel at runtime kept the interface already configured (Phase A — 32 hours of healthy operation after the package upgrade).
• New kernel cold-boots, hits DHCP, never gets an IP, dropbear cannot listen, port 22 stays filtered.

Hetzner’s own documentation has been quietly moving away from ip=dhcp toward static IPv4 in the kernel command line. The fix is exactly that:

GRUB_CMDLINE_LINUX="cryptdevice=/dev/md1:cryptroot ip=A.B.C.D::GATEWAY:255.255.255.255:hostname:eth0:none"

One line in /etc/default/grub, grub-mkconfig, reboot. No more dependency on Hetzner’s DHCP responding to whatever your current kernel sends.

Why it matters for anyone running this stack

If you run Arch on Hetzner Dedicated with full-disk encryption and remote unlock via dropbear, the ip=dhcp shipped by installimage is a latent bug. It can keep working for years and then break overnight, on every machine you have, after a routine pacman -Syyu. The static-IP version is what Hetzner now recommends and removes the entire dependency.

Tooling

While debugging, I turned the whole rescue / chroot / diagnose / fix workflow into a Python CLI (hal) — including hal fix static-ip, which derives the static cmdline directly from your existing systemd-networkd .network file:

→ github.com/kevinveenbirkenbach/hetzner-arch-luks

Single command, idempotent, reversible (the original /etc/default/grub is backed up to .hal-backup). If you’re on this stack, switch to static IP before the next kernel upgrade catches you.

When two Hetzner servers died at the same time

On May 12, 2026, two of my Arch Linux + LUKS servers at Hetzner became unreachable at the same moment. Both had been running for 4+ months without issue. Both had received the same pacman -Syyu the day before, but had stayed on the old kernel until the morning the websites stopped responding. I rebooted — SSH never came back. nmap -Pn -p 22 showed filtered from anywhere. No ping. No banner. The Hetzner Robot panel insisted the hardware was fine.

Several hours went into hypotheses that turned out to be wrong:

• The encryptssh initcpio hook referencing a /usr/lib/initcpio/udev/11-dm-initramfs.rules file that no longer exists. Real bug, no boot impact — the initramfs rebuilds anyway.
• PermitRootLogin no in sshd_config. Real misconfiguration, fixed it, didn’t help. A refusing sshd shows closed, not filtered.
• Predictable interface-naming drift after the systemd 260 upgrade. Patched the .network config to match by MAC. Useful hardening; not the cause.
• Stale GRUB stage1 + core.img in the MBR. Arch never re-runs grub-install after a grub package upgrade. Refreshed it. Still filtered.
• Kernel 7.0.5 regression. Downgraded to 6.18.3, the kernel that had run for 4 months. Still filtered. So the kernel itself wasn’t it either.

The clue was in the persistent journal: a single recorded boot from December 31 to May 12 10:13 UTC, and absolutely nothing after. Every reboot since the upgrade was failing before systemd-journald could flush to disk — so the failure had to be in the initramfs, before the root filesystem was even mounted.

What it almost certainly was

Hetzner Dedicated servers configure the initramfs network with ip=dhcp on the kernel command line. That depends on Hetzner’s DHCP server replying to whatever request format the current kernel sends. Somewhere between kernel 6.18 / iproute2 6.18 and kernel 7.0 / iproute2 7.0, the request format changed enough that Hetzner’s DHCP stopped responding. Effects:

• Old kernel at runtime kept the interface already configured (Phase A — 32 hours of healthy operation after the package upgrade).
• New kernel cold-boots, hits DHCP, never gets an IP, dropbear cannot listen, port 22 stays filtered.

Hetzner’s own documentation has been quietly moving away from ip=dhcp toward static IPv4 in the kernel command line. The fix is exactly that:

GRUB_CMDLINE_LINUX="cryptdevice=/dev/md1:cryptroot ip=A.B.C.D::GATEWAY:255.255.255.255:hostname:eth0:none"

One line in /etc/default/grub, grub-mkconfig, reboot. No more dependency on Hetzner’s DHCP responding to whatever your current kernel sends.

Why it matters for anyone running this stack

If you run Arch on Hetzner Dedicated with full-disk encryption and remote unlock via dropbear, the ip=dhcp shipped by installimage is a latent bug. It can keep working for years and then break overnight, on every machine you have, after a routine pacman -Syyu. The static-IP version is what Hetzner now recommends and removes the entire dependency.

Tooling

While debugging, I turned the whole rescue / chroot / diagnose / fix workflow into a Python CLI (hal) — including hal fix static-ip, which derives the static cmdline directly from your existing systemd-networkd .network file:

→ github.com/kevinveenbirkenbach/hetzner-arch-luks

Single command, idempotent, reversible (the original /etc/default/grub is backed up to .hal-backup). If you’re on this stack, switch to static IP before the next kernel upgrade catches you.

So it turns out #FreeBSD via #PXE only uses #TFTP for the initial boot but expects `/boot/lua/loader.lua` to be loaded via #NFS, the root of which it expects to get via #DHCP but #dnsmasq won't supply this when in proxy mode.

Joy.

So it turns out #FreeBSD via #PXE only uses #TFTP for the initial boot but expects `/boot/lua/loader.lua` to be loaded via #NFS, the root of which it expects to get via #DHCP but #dnsmasq won't supply this when in proxy mode.

Joy.

At home, on most common network which are statefull #dhcp,

You usually get an #ipv4 based on your hardware MAC address, this ensures constancy across device reboot, dual boot (and distro hoping 🙈)

But #ipv6 do not care about the hardware, it will look for a DUID (small string) at /etc/dhcp/duid.

You can persist this file into your dots for your ipv6 address to survive across OS changes.

#linux #archlinux

At home, on most common network which are statefull #dhcp,

You usually get an #ipv4 based on your hardware MAC address, this ensures constancy across device reboot, dual boot (and distro hoping 🙈)

But #ipv6 do not care about the hardware, it will look for a DUID (small string) at /etc/dhcp/duid.

You can persist this file into your dots for your ipv6 address to survive across OS changes.

#linux #archlinux