DHCP on bridge

[edwardwong]

Hi all,

I've bridged OPT1/2 interfaces to my LAN interface, I found that only clients on LAN interface are able to get DHCP offer, clients on other ports of the bridge won't get any offer, but if my client has fix IP then network is accessible, which means only DHCP is not passing to the bridge, any reason? How should I handle this? Thanks.

[edwardwong]

Find the answer myself, the bridge doesn't pass DHCP broadcast by default, I explicitly allow traffic from UDP source port 67/68 to the bridge then everything working well.

[phil.davis]

The code that writes the firewall rules is supposed to put rules to pass port 67/68 when DHCP is enabled. It sounds like there is a bug there when using a bridge, probably the code is writing those rules but not to the correct interface that is being used for firewalling.

[edwardwong]

From what I know, after 1.2RC DHCP traffic won't pass through anymore, they said previously allowing this was a bug, it shouldn't pass traffic that we didn't explicitly allow (but the point is, other than that, ping, normal TCP/UDP traffic are still passing as usual, weird…)

[ndutyme]

Hey Edward,

I am curious because I am trying to do something similar, but I'm afraid it's not supported on pfSense.
Let me know if what you were doing is similar to what I describe below.

Here is what I'm trying to do:
I have multiple subnets between routed gateways that I want pfSense to answer DHCP requests for.
This is done now by a Linux server, with one NIC, no vLANs,  running isc dhcpd6. I'd like to get rid of this Linux box.
All the network routers/gateways are configured with a DHCP-helper. This causes the gateways to send all DHCP requests to the single DHCP server. Then the DHCP server replies with an IP for the subnet pool that matches the gateway that made the request.

Thanks for any info (from anybody).

[Trel]

Before I got a dedicated AP system, I bridged my old WRT on one interface to the second with the wired switch.

Long story short

I needed to change

System -> System Tunables

net.link.bridge.pfil_member to 0
net.link.bridge.pfil_bridge to 1