Posting the solution to ignoring IAID in DHCPv6 server. With the release of pfsense 25.11 kea is now at version 3.0.2 and libdhcp_flex_id.so is included in the release. The below JSON section can be added to DHCPV6 server custom configuration to ignore IAID. { "hooks-libraries": [ { "library": "/usr/local/lib/kea/hooks/libdhcp_flex_id.so", "parameters": { "identifier-expression": "''", "ignore-iaid": true } } ] }

@JeGr https://github.com/pfsense/pfsense/pull/4740/changes/167ce421a20aab2b3b0e1d98a803d582a7ef433a lovely!

@rgijsen Something kea doesn't log, but ISC did : logging allocated leases. Read here how to add these 'leases' logs for kea : https://forum.netgate.com/topic/196313/how-to-change-kea-dhcp-log-level/12 and from then on you have "leases" logs which are auto maintained - they won't grow in size indefinitely - but you have to go look for them the good old way : ssh (or sftp) into your pfSense. @rgijsen said in Seeing Kea DHCP Issues after upgrade to 24.11: and hence I think one client should never exaust a pool A client can't exhaust a pool. A DHCP server recognizes a client with just one unique ID : the client's MAC address. If, for some reason, the client changes it's MAC for every request, then this client will be able to fill up the DHCP pool ... but I never saw a client behave like that. A "DHCP packet capture" (UDP, port 67 and 68 on the interface that shows issues with full packet details) will probably show more clearly what is happening.

@Summer1000 said in WIFI LOGIN PAGE NOT SHOWING WHEN PC & MAC HAVE DNS 8.8.8.8, 1.1.1.1: we have a wifi portal but some laptops & mac have input there own dns like 8.8.8.8 & 1.1.1.1 On a network where you control everything, router and connected devices, you can can use DHCP to assign IP parameters : the DHCP lease will contain the IP, network, gateway and DNS. Or set up some or all settings statically. It's all up to you. But, if you want your device anywhere (like everywhere) else .... then don't use static network settings on your device. When you offer a captive portal to users (devices) you don't control, these device should use the "original" network settings. If they don't, then they can forget about connecting elsewhere. After all, what happens when you take you device on which you've setup up 192.168.10.10 /24 and gateway + DNS 192.168.10.1 to you neighbor, and he is using 192.168.100.1 ? Right, nothing works .... so stick with DHCP on devices. Troubleshooting Captive Portal [image: 1769498716189-2e4da971-16a3-4094-96ce-90185f1b6ea4-image.png] When a device connects to a network that offers a captive portal, nothing passes before authentication (well : one exception : DHCP traffic). Nothing means : no commercial stuff like '8.8.8.8', facebook, etc. Portal connected devices should / have to use use DHCP. You, as the portal admin, should use the default settings for the DHCP server : the gateway and DNS should be the IP of the 'pfSense' portal network. The good news is : every device you buy uses DHCP ... so, out of the box, everything works just fine. I'm using the captive portal for a hotel, and as far as I know, people who want to connect, can connect. The login page shows up every time. To make the most out of portal support : This forum, in the captive portal part, search for "rfc8910" and read everything that's posted about the subject. A lot of devices support RFC8910 these days (all Apple, all Microsoft, and as usual, some androids - the most recent ones will probably work fine), and it makes the portal support a lot faster and reliable The idea is : as soon as the device makes a DHCP request, it will know that : a portal is present. where to find it.

@sam.newby again - pfsense is not involved in it.. Doesn't matter if they got the lease originally from pfsense or not.. When that lease expires they would do a discover and your windows dhcp server would give them a lease.. There is no such thing as a firewall rule for devices on the same network talking to each other - because pfsense is never involved in such communications. Do you have any sort of dhcp snooping setup on your switch infrastructure? This for sure could cause you all kinds of problems if not setup correctly, or if you forget to change it when you bring up a different dhcp server. I would again suggest you sniff on your dhcp server and force a client to do a discover.. Does your dhcp server see the discover.. A discover is a full broadcast - every single device on the network would/should see that traffic.

thank you for this link. Finally update to KeA

@Gertjan I wrote the script yesterday, it has logic to avoid restarting until a configurable number of consecutive failures (in case it happens to run during normal times when you might be e.g.saving config etc) It also kills the running Unbound with progressively more intense methods to make sure the respawn succeeds and leaves you with just 1 instance. I'll post it on GitHub later- happy to get your feedback then (sounds like you don't think this is a good idea?) I'm going to add an option to "report only" and not try to restart the service.

@Gertjan Perfect, thank you.

[image: 1769109778518-ac843c80-c200-4430-a26a-4f092c967e71-image.png]

@SteveITS Its a USB-A to micro-B, i just dont have one available atm. Even if i did i still need to wait

@Masterfryzz Great, glad to hear the script was useful !

So I did clean wipe, full reinstall, yesterday. [image: 1768646224403-cdb57b38-c0f5-4109-b57e-340935df7815-image.png] Today all I did is change DHCP to Kea, configured Interfaces like I want them to be and enabled Python Module in DNS Resolver and disabled DNSSEC. Didn't change any other settings and addded no rules other than default LAN to any to my Bridge0 which I am using (Bridge0 has the IP GW and DHCP. It bridges LAN and VLAN10 interfaces, MY PC is curently connected to LAN port as its still sits on my desk). At that point I installed pfBlockerNG (Im actually writing this as I go along with all this). Noraml one not devel version 3.2.8. [image: 1768646527496-cd820ed8-84e9-4705-b5ca-57eb2d759e19-image.png] Skipped Wizard option and changed the following: [image: 1768646575874-8aad537d-ac0f-451b-9feb-3c4911decce1-image.png] Then went to feeds and added just 1: [image: 1768646624490-73a3b24d-b4f1-4490-8df4-ba0d9957be1c-image.png] Then enabled pfblockerNG. So far no errors and all seems to be working. I will make backup config now and proceed with all other changes I think I might have made before to see when this breaks (if it breaks). I will update if I find the breaking point. But for now I appreciate all the patience and help so far that was provided by all above and on other threads.

Realtek is on test machines, when we go live with pfSense, devices will have Intel NICs. Interesting fact - pfSense rebooted with laptop connected on management port, static IP works, DHCP works. Laptop unplugged from Management port and plugged back again - no DHCP lease, no communication with static IP on laptop, no packets captured on pfSense, as if port is dead. I will try with another kernel driver when we finish last test (HA) and get back to you if it helped.

@Gertjan said in Kea DHCP system logs: Using other (mine) words : it's game over since 2022. Damn, but OK, security is the most important thing, and since it looks like ISC does not work in HA setup I will use, let's forget about the fact that Kea was not working at all on testing start (simple physical interface and basic lease options) and then started to work without valid explanation and log entries. Not the kind of behavior that gives me a peace of mind. What you see is what the Netgate team decided for pfSense 'what to show'. ( you can change his behavior though, some forum posts talk about changing what is logged ... ) That's exactly the reason I posted this. Netgate team, leases to show! The WARN log messages could/should/might be seen as 'kea' start and 'kea stop' as something has to be logged. Waiting for the ERROR messages to indicate that there is no error in operation. You want the actual lease log lines as "dhcpd ISC" did ? Also possible, and a solution for that has been posted here on the forum last year. Found it, JSON Configuration that works, thanks. https://forum.netgate.com/topic/196313/how-to-change-kea-dhcp-log-level/13 { "loggers": [ { "name": "kea-dhcp4.leases", "output-options": [ { "output": "syslog:kea-dhcp4", "pattern": "%m\n" } ], "severity": "INFO", "debuglevel": 0 } ] }

@SteveITS Checked it several times, no problems thrown. Opened up the file to give it a look over and I don't see any show stoppers. I have switched back to ISC for now which removes the problems with unbound. I will attempt a fresh install on the appliance once I get the ability for some downtime.

Thank you @Gertjan for the reply. My next pending will be setting pfBlockerNG DNSBL to "Unbound python mode", and then change DHCP from ISC to Kea.

Thank you @SteveITS for the reply.

Here is a summary of noip.com free vs paid DynDNS. I use them as my domain registrar and email hosting. [image: 1767176618684-screenshot-2025-12-31-at-5.21.57%C3%A2-am.png]