Adding DHCP services from a pfSense to existing VLANs

robrain

pfSense, latest stable, currently providing internet and internal DNS services to our network. pfSense is currently on a dedicated VLAN connected to the core switch via an access port (no trunk, no knowledge of any VLANs).

Fiberstore core switch has SVIs for our VLANs (users, APs, security cameras, audio, etc.). Currently also providing DHCP services to those VLANs via separate pools and also inter-VLAN routing as necessary.

Need to switch to more powerful DHCP server in order to use static assignment and other facilities that the switch can't provide. Don't want the configuration to change other than that - eg routing should still be done by the core switch.

Short timeframe for doing the work and no test lab available - if I add the other VLANs to our pfSense's LAN physical interface (or possibly a different physical interface) and configure DHCP services on those VLANs, can I expect pfSense to stay out of the way otherwise? So no attempt to route, no need to worry about firewall rules for each VLAN, just serve DHCP and that's it?

Thanks

tgl

@robrain Oy, you're setting yourself up for failure.

Each VLAN interface you add to the pfSense setup will have its own forwarding ruleset, and I believe the behavior with zero rules is default-deny, so yeah the firewall will not route anything. (It will let traffic reach the pfSense DHCP server without a rule, interestingly enough, so I suppose there's behind-the-scenes magic to insert a rule allowing that.)

However, there are multiple moving parts in this configuration, including creating the VLAN interfaces and setting up the per-VLAN DHCP services. If you haven't done that before, experimenting on a live network doesn't sound like a recipe for success. Especially since you can't afford to have both the pfSense and Fiberstore DHCP servers active at the same time for any VLAN.

I think you need to push back on "do this on a short time frame without any pre-testing".

robrain

@tgl too new to upvote - thanks for your comment.

I can experiment on my home 6100 for the VLAN and DHCP stuff - strangely though I don’t have an FS 8550 spare there though for the routing side of things!

Your point is well-taken, I’ll see what spares I can lay my hands on at the client (it’s my brother, he’ll understand).

tgl

@robrain That sounds more like a plan.

BTW, if you've not used pfSense's DHCP stuff before: they offer both ISC and Kea DHCP implementations, but I gotta recommend that you use ISC. Kea doesn't seem to have all the bugs out yet.

johnpoz

@robrain what sort of network is this - there are no servers? Windows, Linux? That you could run a more powerful dhcp server on, and just forward that on your core switch - cisco would call it an ip helper that just points to the IP of your dhcp server.

robrain

@johnpoz a valid question. Currently there are indeed no servers on the network, or at least none that I’m going to run DHCP on. We are speccing up a resilient proxmox implementation currently for non-music related stuff, but my thought was we’ve got a nice bit of equipment already in place, integrated with the DNS etc, why not let it take the strain?

johnpoz

@robrain because you routing at the switch.. If pfsense was already doing the routing your vlans then sure I would say go for it.

But you adding a leg into a vlan can cause asymmetrical routing. Sure your client can send the traffic to the svi on the switch as its gateway.. Say from 192.168.0.100, then switch sends it on to pfsense via the transit network you have with it. But when pfsense goes to return the answer - its going to send it out the leg it has in this 192.168.0 network. Or at least it can. And most likely will.

Your going to introduce complexity for something as simple as a dhcp server - spin up a vm on you proxmox for dhcp services if your switches feature set it not up to the task.

Unless pfsense in the latest update (26.07 or 2.9) allowed for running dhcp without having a leg in that L2. Maybe with kea it can do that now - You would have to check the release notes, I don't remember seeing that if it was in there.

robrain

@johnpoz thanks. Understood.