Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DHCP - Multiple Interfaces - possible bug?

    Scheduled Pinned Locked Moved DHCP and DNS
    13 Posts 2 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bjk002
      last edited by

      I am no expert here, so please forgive if I am saying something incorrectly. And I'll preface that PFSENSE is a great product. And it is quite possible that my own ignorance is causing some issue I am unaware of, but I have been dealing with this for a few days and need to ask the community at this point.

      I have PFSense running, community edition, version 2.4.5-RELEASE. I have 5 interfaces defined as such:
      61adb47d-0e95-413e-ac5e-de86ad0c9bf7-image.png

      I have DHCP running on each interface (LAN, DMZ, DMZ_WEB), each with their own subnet (10.1.1.0/24, 10.1.2.0/24,10.1.3.0/24) respectively.

      Each interface has some amount of static mappings defined and in DNS resolver (to internal DNS) I am registering DHCP leases, static mappings, and connected VPN clients (OpenVPN).

      Everything seemed to be working fine for the first few weeks. Clients in each subnet were getting assigned their respective IP Addresses as expected and no issues were noticed.

      Then, about 4 days ago I noticed that the DHCPD Service status on the dashboard was reporting as offline and some (but not all) clients were reporting offline. Ping tests validated the clients were no longer accessible.

      What I found was if I disabled DHCP on any one of the three interfaces (LAN,DMZ, DMZ_WEB), the DHCPD service status on the dashboard reported as running, and clients for those interfaces would then become accessible with active leases.

      Of course, clients associated with the third interface would not be available after any exiting leases expired (for testing purposes I set the lease renewal interval to just 2 minutes).

      So I find this behavior very odd. It does not matter which of the three interfaces has their DHCP disabled. If any one is disabled, the status reports running on the dashboard and clients receive their leases on the other two subnets as expected.

      For my own sanity, is there a known bug out there on this issue?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        huh? If dhcpd is running on any interface - it will show running. But no it will not be running on the interface you shut it off on?

        If your saying the dhcpd went offline, and then you disabled it on interface X, and then it showed running.. I would assume that your change in the config did a restart of the whole service, so yes those networks where it was enabled would now be able to get IPs again.. If for some reason dhcpd as a whole had shutdown/crashed.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        B 1 Reply Last reply Reply Quote 0
        • B
          bjk002 @johnpoz
          last edited by

          @johnpoz - Sorry John, let me try to be more clear.

          If I have DHCP set to be running on each of the three interfaces (all 3), then on the dashboard page the service shows as stopped AND leases expire and are not renewed across all 3 interfaces, despite being enabled:

          40e1697b-bc4c-48f3-8692-462e9c664158-image.png
          188cc815-5fff-44d0-9b59-1e892210e2bb-image.png
          249f0349-794d-45c2-a964-8c3f9d8a21a2-image.png
          933c545a-182e-4ee2-ab39-431e11c343a8-image.png

          If I then disable DHCP on just one interface, the dashboard page the service shows as running, and leases are then made available for clients associated with the two remaining interfaces:
          40e1697b-bc4c-48f3-8692-462e9c664158-image.png
          188cc815-5fff-44d0-9b59-1e892210e2bb-image.png
          c01171db-3558-42eb-b3c8-98595ac3aa38-image.png
          c202030b-cfce-4cbc-a19b-5b9d84760296-image.png

          This will happen and can be validated regardless of which interface DHCP gets disabled.

          So basically, if any two interfaces have DHCP running, the service works as expected. But if a 3rd is introduced DHCP stops running across all interfaces.

          Is that more clear?

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Again.. Yes if say the dhcpd crashes/shuts down for some reason.. The service would show as down.. since it is.. But you making a change, like disabling specific interface.. Would cause pfsense to restart the service to reflect the new change in config.. So if the dhcpd was down, this change in config would cause a restart of it, or bring it back up because it was down.

            You could also just hit the button to restart the service without making any changes to the config.

            startservice.jpg

            Does your log show why the service crashed or shutdown? If you hit that button and it doesn't restart the log should reflect why..

            I have dhcpd running on way more than 3 interfaces ;)

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • B
              bjk002
              last edited by

              Log report after trying to start DHCP service from services dashboard (hitting that button) with all 3 interface's DHCP enabled (it failed to start):

              edbd52b8-cda0-4c81-a3c5-a2fdbd72c387-image.png
              b0ceefec-2df0-4fdb-b224-26feb9403a29-image.png

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                Looks like a problem with hn2 - says matches multiple shared networks... What networks do you have on these networks with masks.

                error.jpg

                Pfsense shouldn't allow you to create overlapping networks... But you could have an issue that slipped through or you changed mask after the network was created?

                What are the networks you have on all of your interfaces?

                Quick easy way to look and show this info would be just your menu when you ssh to the box - example here are mine.. Just hit networks that have public on them.

                networksmasks.jpg

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • B
                  bjk002
                  last edited by

                  3841fdcb-ed81-45b9-ae5c-23923b44c1f4-image.png

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    Well as long as your wan doesn't start with say 10.x something I don't see any overlap there..

                    Can you show say the dhcp server settings for that hn2 network (dmz) and your other.. Maybe there is something wrong in the config where it didn't update or something.

                    dhcp.jpg

                    Give me a sec - we should be able to just look directly in the dhcpd.conf - one sec let me find the path, and post up mine as example.

                    Look at the dhpd.conf here
                    /var/dhcpd/etc

                    Do you see anything that overlaps?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • B
                      bjk002
                      last edited by

                      Sure thing:

                      6c14426b-b2e2-4257-8885-98c05ac8aa9e-image.png
                      36491df3-fc6d-4caa-bf32-21398d086425-image.png
                      a4984c5d-7e2b-442e-913f-bd65d7752ab8-image.png

                      I appreciate you keeping engaged, thanks.

                      I have to run for a job, but will be back online later this evening.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        Well don't see anything overlapping there.. Odd.. The way I am reading that error is dhcpd thinks for some reason there is an overlap. Best to look direct in the dhcpd.conf

                        In your dhcpd.conf do you have this called out anywhere "shared-network"

                        Do you have any vips setup on pfsense?
                        https://redmine.pfsense.org/issues/6834

                        For example pfblocker can setup a vip??

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • B
                          bjk002
                          last edited by

                          I reviewed dhcpd.conf @ /var/dhcpd/etc/ , but did not see anything regarding "shared-network". everything seems fine/normal within the conf file.

                          However, yes, I DO have two VIPs configured in association with haproxy, and I AM working with NAT as a result of the work with haproxy.

                          I have been setting up haproxy for a variety of use cases. I would not have thought there was such an association. Very interesting... I will read through this in detail tomorrow, run some tests, and report back.

                          Thanks for the clue.

                          1 Reply Last reply Reply Quote 0
                          • B
                            bjk002
                            last edited by

                            To wrap this up... it was this same issue with a misconfigured VIP (https://redmine.pfsense.org/issues/6834). Essentially, in a VIP, you define the interface and an IP. If they do not align properly, this issue seems to surface.

                            A bit hard to track down, but now everything is working properly. Thanks John!

                            1 Reply Last reply Reply Quote 1
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Glad you got it sorted!

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.