pfSense DHCP Server - Configuration and Static Mappings

The DHCP server in pfSense automatically distributes IP addresses to clients from predefined pools while transmitting network configuration parameters - gateway, DNS servers, domain name, and lease duration. The server is configured independently for each interface, enabling tailored settings for different network segments. pfSense supports two DHCP backends - Kea DHCP (modern, recommended) and ISC DHCP (deprecated, scheduled for removal in future releases). Backend selection is available at System > Advanced > Networking > Server Backend.

Enabling the DHCP Server

DHCP server configuration is performed through Services > DHCP Server. The configuration page contains separate tabs for each interface capable of serving DHCP addresses.

To activate the server on a specific interface:

1. Navigate to the tab for the desired interface (LAN, OPT1, etc.)
2. Check Enable DHCP server on [interface] interface
3. Define the address pool range
4. Click Save

Warning:

The DHCP server operates only on interfaces with statically assigned IP addresses. If an interface is configured to obtain its address via DHCP or PPPoE, enabling the DHCP server on that interface is not possible.

Address Pool Configuration

The address pool defines the range of IP addresses that the DHCP server distributes to clients. The range is specified using the From (starting address) and To (ending address) fields and must fall within the interface subnet.

Core Pool Parameters

Additional Pools

Multiple address pools within a single subnet can be created using the Add Address Pool button. This is useful when different device categories on the same interface require separate ranges - for example, one pool for workstations and another for printers with different lease parameters.

Planning Recommendations

When planning the address pool, several practical considerations apply:

• Reserve addresses at the beginning of the subnet for the gateway, servers, and network equipment (e.g., .1 through .20)
• Allocate a separate range for static mappings outside the dynamic pool
• Account for potential device count growth when selecting the subnet size
• Set lease times according to device type: short (1-2 hours) for guest networks with high turnover, longer (8-24 hours) for corporate workstations

Static Mappings

Static mappings ensure that a specific device always receives the same IP address based on its MAC address. Unlike fully static configuration on the device itself, the device continues using the DHCP protocol but consistently receives the assigned address.

Creating a Static Mapping

To create a mapping, navigate to Services > DHCP Server, select the interface, and click Add in the DHCP Static Mappings section.

Warning:

The IP Address field specifies a preferred address, not a hard reservation. If the specified address is already in use, the DHCP server may assign a different address from the pool. To guarantee address persistence, select an IP outside the dynamic pool range.

Practical Applications

Static mappings are recommended for:

• Servers and network equipment that require fixed addresses for firewall rules and NAT
• Printers and multifunction devices configured by IP address
• IP phones with number-to-address binding
• IoT devices that do not support static network configuration
• Administrator workstations requiring fixed access

Static ARP Option

When Static ARP is enabled at the interface level, pfSense creates static ARP table entries for all devices with static mappings. Devices without a mapping cannot communicate with the firewall through that interface, even if they configure an IP address manually. This provides an additional layer of access control at the data link layer.

Unknown Client Handling

The Deny unknown clients parameter controls DHCP server behavior when receiving requests from devices without a static mapping.

Restrictive modes are valuable in environments with heightened security requirements where connecting unauthorized devices to the network must be prevented. Combined with Static ARP, this provides MAC-level access control.

DHCP Relay

DHCP Relay is used when the DHCP server resides in a different subnet. Instead of distributing addresses locally, pfSense forwards client DHCP requests to a remote server and returns the responses.

Configuring DHCP Relay

Configuration is performed through Services > DHCP Relay.

1. Check Enable DHCP Relay
2. Enter the remote DHCP server IP address in the Destination Server field
3. Select the interfaces on which to intercept DHCP requests
4. Click Save

Warning:

DHCP Relay and DHCP Server cannot operate simultaneously on the same interface. Enabling Relay automatically deactivates the local DHCP server on the selected interfaces.

Use Cases

• A centralized DHCP server (Windows Server, ISC DHCP, Infoblox) serving multiple subnets through Relay on pfSense
• Branch office networks with a single DHCP server at headquarters connected via VPN tunnel
• Migration from a dedicated DHCP server: during the transition period, pfSense forwards requests to the existing server

Additional DHCP Options

pfSense can transmit extended configuration parameters to clients through additional DHCP options.

Built-in Options

Network Booting (PXE/UEFI)

To configure network booting, enable Enable Network Booting and specify:

Custom Options (ISC DHCP Only)

The Additional BOOTP/DHCP Options section allows defining arbitrary DHCP options by number, type, and value:

• Number - option code per IANA standards
• Type - data type (Text, String, Boolean, Unsigned Integer 8/16/32, Signed Integer 8/16/32, IP address or hostname)
• Value - option value

Custom options enable transmitting device-specific parameters for VoIP equipment, thin clients, IP cameras, and other devices supporting extended DHCP options.

MAC Address Control

Advanced settings allow restricting service by MAC address:

• Allow - comma-separated list of permitted MAC addresses; all others are rejected
• Deny - comma-separated list of blocked MAC addresses; all others are served

DHCPv6 and Router Advertisements

pfSense supports IPv6 address distribution through DHCPv6 and Router Advertisement (RA) configuration for client autoconfiguration.

DHCPv6 Configuration

DHCPv6 configuration is available at Services > DHCPv6 Server & RA. Each interface provides two tabs: DHCPv6 Server and Router Advertisements.

Core DHCPv6 parameters mirror those of DHCPv4:

• Address range (Range)
• IPv6 DNS servers
• Domain name
• Lease times (Preferred and Valid Lifetime)
• Static mappings by DUID (DHCPv6 Unique Identifier)

Router Advertisements

Router Advertisements determine how IPv6 clients obtain their addresses.

Warning:

The Router Advertisements mode must be coordinated with DHCPv6 settings. When set to Unmanaged, the DHCPv6 server will not process address assignment requests, even if it is enabled.

DNS Integration

The pfSense DHCP server supports automatic hostname registration in the DNS Resolver (Unbound). When a DHCP request includes a hostname, the server creates a corresponding DNS record, allowing devices to be reached by name instead of IP address.

Enabling DNS Registration

Automatic registration is configured in the DNS Resolver (Services > DNS Resolver):

• DHCP Registration - register hostnames of dynamic clients
• Static DHCP - register hostnames from static mappings

Detailed DNS Resolver configuration is covered in DNS in pfSense .

Dynamic DNS (ISC DHCP Only)

When using the ISC DHCP backend, hostname registration on an external DNS server is available through the Dynamic DNS protocol:

• DDNS Domain - domain for client registration
• Primary/Secondary DDNS Address - DNS server addresses for record updates
• DNS Domain Key Name and Secret - credentials for update authentication
• DDNS Client Updates - policy for handling client DNS update requests (Allow, Deny, Ignore)

Viewing Active Leases

The list of current DHCP leases is available at Status > DHCP Leases. The page displays:

• Client IP address and MAC address
• Hostname (if provided by the client)
• Lease start and expiration times
• Lease type (dynamic or static)
• Device online status

From this list, a static mapping can be created for any active client by clicking Add Static Mapping next to the corresponding entry. Wake on LAN functionality is also available for devices supporting remote wake-up.

Troubleshooting

Client Does Not Receive an IP Address

1. Verify that the DHCP server is enabled on the appropriate interface (Services > DHCP Server)
2. Confirm that the pfSense interface IP address is statically configured
3. Check that the address pool is not exhausted (Status > DHCP Leases)
4. Verify that Deny unknown clients is not enabled for a device without a static mapping
5. Check firewall rules - DHCP uses UDP port 67 (server) and UDP port 68 (client)
6. Review the system log: Status > System Logs > DHCP

Client Receives an Address from the Wrong Pool

1. Verify that the client is connected to the correct interface or VLAN
2. Confirm that the primary and additional pool ranges do not overlap
3. If a static mapping exists, verify that the specified address falls within the interface subnet

DHCP Relay Not Working

1. Confirm that the DHCP server is disabled on interfaces used for Relay
2. Test routing to the remote DHCP server using Diagnostics > Ping
3. Verify that firewall rules permit DHCP traffic (UDP 67/68) between pfSense and the remote server
4. When using a VPN tunnel, confirm that the DHCP server subnet is reachable through the tunnel

IP Address Conflicts

1. Check whether the address is statically assigned on another device
2. Verify that static mapping addresses do not fall within the dynamic pool range
3. Enable Ping Check (ISC DHCP only) to verify address availability before assignment

Migration from Other Platforms

Migration from Cisco IOS DHCP

In Cisco IOS, DHCP pools are configured globally and bound to a subnet. In pfSense, each pool is tied to a specific interface.

Migration from FortiGate

In FortiGate, the DHCP server is bound to an interface similarly to pfSense. Key differences include:

• FortiGate uses MAC Access Control List - the pfSense equivalent is implemented through Allow/Deny MAC in advanced options
• Address reservations in FortiGate are configured via config reserved-address - pfSense uses Static Mappings
• FortiGate supports hardware-level DHCP snooping - pfSense implements control through Static ARP

Migration from MikroTik

In MikroTik, the DHCP server, pool, and network parameters are configured as separate objects. In pfSense, all parameters are consolidated on a single interface page.

Related Sections

• DNS in pfSense - configuring DNS Resolver for DHCP hostname registration
• VLAN Setup - creating VLAN interfaces with individual DHCP configuration
• CARP and Virtual IPs - using CARP VIPs as gateway for failover DHCP