I understand the DHCP now, :) ,i try it on my virtualbox.
if you open " Enable DHCP server on LAN interface " every client can get ip address from pfsense .and every client can access LAN ip.
if you open " Deny unknown clients " just the client in the " DHCP lease table " can get ip address from pfsense.if you are a geust of the LAN , pfsense don`t do anything for you .
if you open " Enable Static ARP entries " the client can not change ip manual ,if changed client will can not access LAN ip and WAN.
i know why binding IP–MAC must need DHCP service now , focus in " Deny unknown clients " . pfsense think the guest pc should not be get ip from pfsense , but whois guest ? Except the " DHCP lease table " !
thanks every one answer my topic !! and thanks pfsense open source firewall team .