Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No free lease on fresh install

    Scheduled Pinned Locked Moved DHCP and DNS
    14 Posts 4 Posters 952 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      MickaMickaTchu
      last edited by

      Hello,

      I'm new here, I'm writing this post because I need some advices please.

      I just installed one pfsense with a classic configuration (wan/lan).
      For the wan : 10.0.1.0/24 ==> Static
      For the lan 10.0.3.0/24

      I would like to activate the DHCP Server only if the Mac address match with the following characters : 52:52:CE:52

      But before do it I enabled the DHCP server in order to test it, and sadly I'm stuck at this step... I have always the same message:

      Aug 20 13:39:13dhcpd64273DHCPDISCOVER from 52:54:ce:52:09:76 via vtnet1: network 10.0.3.0/24: no free lease
      Aug 20 13:40:36dhclient39164FAIL

      The dhcp.lease file is

      # The format of this file is documented in the dhcpd.leases(5) manual page.
      # This lease file was written by isc-dhcp-4.4.2-P1
      
      # authoring-byte-order entry is generated, DO NOT DELETE
      authoring-byte-order little-endian;
      
      server-duid "\000\001\000\001(\262E\254RT\316R\256\320";
      

      The DHCPD.conf file is the following

      option domain-name "lab.lan";
      option ldap-server code 95 = text;
      option domain-search-list code 119 = text;
      option arch code 93 = unsigned integer 16; # RFC4578
      
      default-lease-time 7200;
      max-lease-time 86400;
      log-facility local7;
      one-lease-per-client true;
      deny duplicates;
      update-conflict-detection false;
      authoritative;
      class "5254ce520101" {
              match if substring (hardware, 1, 6) = 52:54:ce:52:01:01;
      }
      class "s_lan" {
              match pick-first-value (option dhcp-client-identifier, hardware);
      }
      subnet 10.0.3.0 netmask 255.255.255.0 {
              pool {
                      allow members of "5254ce520101";
                      deny unknown-clients;
      
                      range 10.0.3.50 10.0.3.100;
              }
      
              option routers 10.0.3.1;
              option domain-name-servers 10.0.3.1;
              ping-check true;
      
      }
      

      The Mac address is exactly the mac address of my computer, even if I remove this check, I do not have any offer from my DHCPServer.

      On the client side : I have only one computer (W10, fresh install).

      Do you have any clue please?

      Thank you in advance,

      bingo600B GertjanG johnpozJ 3 Replies Last reply Reply Quote 0
      • bingo600B
        bingo600 @MickaMickaTchu
        last edited by

        @mickamickatchu
        Can you show the dhcp config file , when you have disabled the check ?

        /Bingo

        If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

        pfSense+ 23.05.1 (ZFS)

        QOTOM-Q355G4 Quad Lan.
        CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
        LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

        1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @MickaMickaTchu
          last edited by

          @mickamickatchu said in No free lease on fresh install:

          DHCPDISCOVER from 52:54:ce:52:09:76 via vtnet1: network 10.0.3.0/24: no free lease

          That's

          52:54:ce:52:09:76
          

          and the DHCP server wants

          52:54:ce:52:01:01
          

          so he refuses the give a lease ?

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          1 Reply Last reply Reply Quote 0
          • M
            MickaMickaTchu
            last edited by

            Hello @bingo600 Hello @Gertjan

            Below the file

            option domain-name "lab.lan";
            option ldap-server code 95 = text;
            option domain-search-list code 119 = text;
            option arch code 93 = unsigned integer 16; # RFC4578
            
            default-lease-time 7200;
            max-lease-time 86400;
            log-facility local7;
            one-lease-per-client true;
            deny duplicates;
            update-conflict-detection false;
            authoritative;
            class "s_lan" {
                    match pick-first-value (option dhcp-client-identifier, hardware);
            }
            subnet 10.0.3.0 netmask 255.255.255.0 {
                    pool {
            
                            range 10.0.3.50 10.0.3.100;
                    }
            
                    option routers 10.0.3.1;
                    option domain-name-servers 10.0.3.1;
                    ping-check true;
            
            }
            
            
            

            @Gertjan Good job, it's indeed an error on my side, but even if the mac address is equal I have the same error.
            Oh I'm running these virtual machine on KVM (In case of.

            bingo600B 1 Reply Last reply Reply Quote 0
            • M
              MickaMickaTchu
              last edited by

              After a reboot, if I do not put any condition on the mac address I get one IP.
              If I put any condition on the mac address i get nothing.
              I did a wireshark on the PFSENSE while I'm asking a new IP on my client.
              alt text

              1 Reply Last reply Reply Quote 0
              • bingo600B
                bingo600 @MickaMickaTchu
                last edited by bingo600

                @mickamickatchu

                Edit: I didn't see your above post , before i wrote this post.
                So now it works wo. MAC matching , and gives a DHCP IP.

                I expect the dhcp server to be ISC-DHCP , use of that is extensively documented on the net

                /Bingo

                *** Old Post
                And the above config still give "No free leases" ?
                That's strange ??

                Can you show the log ?

                The first log said it received the request on interface vtnet1 (Kinda' gave away it was a VM) , is that IF your lan IF ?

                /Bingo

                If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                pfSense+ 23.05.1 (ZFS)

                QOTOM-Q355G4 Quad Lan.
                CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                1 Reply Last reply Reply Quote 0
                • M
                  MickaMickaTchu
                  last edited by MickaMickaTchu

                  Edit: now it's works if I remove the Mac Matching.. With it I didn't get any ip

                  @bingo600 Without any condition on the mac address, I got an IP.
                  If I put any condition on the mac address nothing works..

                  Indeed, I used KVM:

                  • Wan => 10.0.1.0/24 => NAT.
                  • LAN => 10.0.3.0/24 => Isolated Network.

                  is it a problem if the pfsense is a vm?

                  bingo600B 1 Reply Last reply Reply Quote 0
                  • bingo600B
                    bingo600 @MickaMickaTchu
                    last edited by

                    @mickamickatchu said in No free lease on fresh install:

                    Edit: now it's works if I remove the Mac Matching.. With it I didn't get any ip

                    @bingo600 Without any condition on the mac address, I got an IP.
                    If I put any condition on the mac address nothing works..

                    Indeed, I used KVM:

                    • Wan => 10.0.1.0/24 => NAT.
                    • LAN => 10.0.3.0/24 => Isolated Network.

                    is it a problem if the pfsense is a vm?

                    I would not expect the VM to cause this , as a "Unconditional config" hands out a DHCP address. That proves that the "network path" is ok.

                    Maybe someone more experienced in pfSense DHCP & Mac-matching could chime in ....

                    /Bingo

                    If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                    pfSense+ 23.05.1 (ZFS)

                    QOTOM-Q355G4 Quad Lan.
                    CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                    LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @MickaMickaTchu
                      last edited by johnpoz

                      @mickamickatchu said in No free lease on fresh install:

                      52:52:CE:52

                      That is not a full mac address, if your trying to set a reservation? You would need the full mac..

                      Are you trying to only hand out mac if mac starts with that - and you don't care what the IP is? I believe that only uses first 3, not 4.. A screenshot of your dhcp server settings would be easier to read..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      GertjanG 1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @johnpoz
                        last edited by Gertjan

                        I think @MickaMickaTchu is working with this :

                        178afe3e-82ea-47be-9249-de528b12648b-image.png

                        ( but dono why he doesn't say so, and shows us instead the config files ...)

                        I do recall something about writing MAC partial strings for ISC DHCP server :

                        https://www.linuxquestions.org/questions/linux-networking-3/isc-dhcp-class-matching-based-on-mac-address-825866/

                        I know, this is old, very old, and can't tell if it's still a 'ISC' thing.

                        I do remember this one : https://forum.netgate.com/topic/90883/isc-dhcp-server-not-matching-partial-of-the-mac-address

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • M
                          MickaMickaTchu
                          last edited by

                          Hello,

                          So Why I don't take a screenshot, and share directly the config file:
                          Because when I rode some topics, the persons asked for config file.
                          So I don't know what I must paste into.into this forum.

                          Indeed I speak about the "Mac Allow" and based on the documentation : https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv4.html#mac-address-control
                          We can have partial mac address into this field.

                          Below two captures of my configuration, if you need more tell me =)

                          alt text

                          alt text

                          Thank you for your help!

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @MickaMickaTchu
                            last edited by

                            @mickamickatchu This could prob use some better wording in the docs and description.

                            deny.jpg

                            But with your setting like that - unless you have a reservation set, the client will not get a lease.

                            You can use the mac access controls to allow deny for which clients get which IPs out of more than one pool, etc.

                            And I also believe used to control which can get a lease when you have deny unknown to allow.. But in your current config - yeah since there is no specific reservation set, you would not get a lease.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • M
                              MickaMickaTchu
                              last edited by

                              Oh I see, thank you,

                              So, if I understand well, my main problem is that I don't have any specific reservation set. But I will not be able to know the Mac address.

                              Actually, I have one interface but I plan to have two interfaces, and inside them I will don't know the mac address of the machines. I can set the beginning (like 52: 54: CE: 51) and I thought it was the solution to my problem but apparently no.

                              my objectif is to have a reservation range of IP for each interface. e.g: Lan 1 => 10.0.3.0/24, LAN2 => 10.0.4.0/24. At this step if I enable DHCP on LAN1 interface, a machine plugged to the LAN2 interface can get an IP from LAN1 DHCP

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @MickaMickaTchu
                                last edited by johnpoz

                                @mickamickatchu said in No free lease on fresh install:

                                At this step if I enable DHCP on LAN1 interface, a machine plugged to the LAN2 interface can get an IP from LAN1 DHCP

                                Well then your setup is broken.. And you don't actually have isolation between your networks. Your 2 networks should be either physically isolated, or isolated via vlans. There should be no way lan 1 interface would ever see a discovery from lan 2 network since they should be isolated at layer 2. And vise versa, 2 should never see discovery broadcasts from network 1

                                I have 8 different networks, all correctly isolated at layer 2.. dhcp on network A, never sees broadcast from any other network, etc. Trying to isolate devices by just using different IP space when they sit on the same network is not valid from a security point of view. You can isolate at layer 2 even if everything is virtual. You just need to setup your vitual network and how it connects to your physical network correctly to do so.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.