Firewall for DHCP requests
-
Hi everybody :)
I have multiple interfaces with separate VLANs on my pfSense router :
-
wan
-
dmz
-
servers
-
workstations
I'd like the workstations to obtain IP addresses from the DHCP server (behind the "servers" interface).
I added a firewall rule on the workstations interface : Pass UDP (67,68) from any source to the servers subnet
But DHCP requests are broadcasted (255.255.255.255) so my rule won't let them through the interface.
If I put "any" as a destination, I'm afraid a server located in the DMZ zone could answer the request.
So, how could I allow only the DHCP server behind the "servers" interface to answer DHCP queries from workstations?Thanks.
-
-
via dhcp relay under services.
Does not matter what rules you put in, your not going to pass broadcast traffic across segments.. If you want to have some other dhcp server hand out IPs for a segment then use the dhcp relay option. You can not be running a dhcp server on pfsense to use this feature.
-
Thank you very much ! This is exactly what I wanted and I was missing it…
There's a problem though : my "workstations" interface isn't shown in the list (it has an IP address assigned to it), but I can see every other interface.Edit : whoops, my bad.
-
There's one thing I don't understand :
If I want to enable DHCP relaying from workstations to servers AND from wan to DMZ, how would I do this? (I know this is dumb, but it's just an example).
-
Why would you do such a thing? You use dhcp relay because you want to leverage 1 dhcp server for all you networks Why would you want to send a different segment to a different dhcp?
If you have a segment that you don't want it to use your relay - run a dhcp server on that segment for that segment.
