DHCP Server to Specific Interface Only
-
I have a Netgate 4100 Max on pfSense 23.09. My network has an existing DHCP server that works fine for my needs and serves about 100 devices. However, for one particular edge case, I would like my Netgate to act as a DHCP server, but only on one of its interfaces. For those who are curious, I have a Ubiquity Dream Machine that I'm not using as a gateway. I would like the Netgate to serve the UDM's WAN port with an IP address without affecting the rest of the network. The UDM's LAN port will be on the network switch and will receive a normal DHCP address like the rest of the network devices. It's a bit of a hack, but apparently necessary to use the UDM like it wasn't intended to be used. I'm just not ready to switch away from my Netgate to the UDM yet.
So the question is, how do I configure pfSense to serve DHCP only on one interface?
-
@nathon said in DHCP Server to Specific Interface Only:
how do I configure pfSense to serve DHCP only on one interface?
That is how it works out of the box.. You didn't "bridge" your nice discrete interfaces did you?
-
@johnpoz No. Maybe I'm just misunderstanding then. I see a single DHCP Server setup under System > Advanced > Networking. It doesn't specify what that DHCP Server is going to serve addresses to... LAN1 (OPT1), LAN2 (OPT2), LAN3 (OPT3), etc. Since my home network is plugged into LAN1 (OPT1), serving IP addresses on that interface would be bad. However, I want to plug my UDM into LAN2 (OPT2) and have it serve IP addresses there. I just need to know how to set that up.
-
@nathon that settings if for which dhcp server you want to use.. the isc dhcp server has been used for long time. It is going away at some point in the future. So you can choose which one you want to use isc or kea. Kea while in preview mode (its not yet fully integrated into pfsense).. You can use that one if you want or just stick with isc for now - which is what I would suggest.
You setup your dhcp server for different networks on the under dhcp server settings.
Here is where you make all the settings for that specific networks dhcp settings, what the pool is, any different settings you want to hand out, etc..
keep in mind if your using the kea new preview - it is missing quite a few features currently. You should prob read over this on why they are moving to it, etc..
https://www.netgate.com/blog/netgate-adds-kea-dhcp-to-pfsense-plus-software-version-23.09-1
And then prob read over the specific release notes
https://docs.netgate.com/pfsense/en/latest/releases/23-09.html#rn-23-09-kea
-
@johnpoz Thank you. That connected a lot of dots for me. The only issue now is that only LAN1 is appearing in the Services > DHCP Server section. When I select DHCP Server under Services, it goes directly to LAN1 and no other interface tabs are available at the top. I have LAN2 enabled and an IP address assigned. Does it have to actually be "UP" to appear? I'm looking to configure all of this before actually wiring it. If I have to do that in reverse, that's fine as well.
-
@nathon if your interface is not actually enabled, then no you wouldn't be able to mess with its dhcp server settings.
Another issue I see quite a bit actually, is when you go and put an IP on a new interface, the drop down for the /mask on the IP be it 16 or 24 or 29 or 8 even, etc. defaults to /32
Well that is just an IP no real network, so there is no IPs that could be handed out via dhcp, so if your interface IP only has a mask of 32 you won't see the dhcp tab for it.
-
@johnpoz It was enabled, but success. I did the big dumb. Sure enough, /32... good grief. I need to call it a day. Thank you for explaining the relationship between the System > Advanced > Networking area and the Services > DHCP Server area. I had never even noticed the LAN1 tab at the top since it was all that was ever enabled for me. Your post completely opened my eyes as to how this works. It makes complete sense now. Thank you so much for your time!
-
@nathon said in DHCP Server to Specific Interface Only:
I did the big dumb. Sure enough, /32
Not sure would use that word, its a common mistake actually.. There has been past discussion of maybe a /24 would be a better "default".. But in the end the person putting the IP should validate the mask is correct for their use, so what the default is shouldn't matter..
-
@johnpoz Okay, a silly oversight on my part. Hard to justify a mask that's all network side. I should have caught that.
However, my opinion is you're correct. A /24 would be far more common and useful as a default. Anyway, have a great new year!
