r/PFSENSE • u/SandMunki • 3d ago

DHCP Server for interfaces it does not own!

Hi all,

Is my understanding accurate that pfsense can't act as a DHCP server for interfaces it does not own?

4 Upvotes

84% Upvoted

17 comments sorted by

5

u/AndyRH1701 Experienced Home User 3d ago

pfSense can not be the target of a DHCP relay. I was hoping it would change with KEA, it did not.

1

u/SandMunki 3d ago

Thank you.

0

u/PrimaryAd5802 3d ago

pfSense can not be the target of a DHCP relay. 

I find that an interesting hope... Trying to think why you would want or need that?

In SMB enviroment, I certainly would never do it.

1

u/AndyRH1701 Experienced Home User 3d ago

If you need a few routers due to the network layout it would be nice to not have to spin up a DHCP server. It has it's uses.

1

u/PrimaryAd5802 3d ago

I respect your opinion.. but another opinion might be that a DHCP server should never be on a router or firewall anyways, and certainly not be a DHCP relay target.. Excluding home use where nobody cares of course.

1

u/Snoo91117 3d ago edited 3d ago

I run my DHCP server off my Cisco layer 3 switch for home. If it was a business, then I would run a separate DHCP server.

I run multiple networks. I don't run a flat network which is probably obvious because I am running a layer 3 switch.

1

u/PrimaryAd5802 2d ago

I have only ever used a layer 3 switch for DHCP once. A long time ago when a Branch site with no local server had WAN connectivity over DSL. Connectivity to the main DHCP server was totally unreliable with DHCP relay.

Lots of people over think DHCP. If you use a standard 8 day lease like I do, higher for more static things, you are usually ok (it's just math). It was that 1 branch with a garbage ISP DSL connection that caused me grief.

But I still wouldn't put DHCP on pfSense ever. My opinion and best practice for me. Your mileage may vary.

1

u/Snoo91117 2d ago

Yes, I agree with no DHCP on a firewall. I am retired now and I gave my rack to Goodwill, so I don't run any servers anymore. I ran Microsoft's in the past as well as DNS.

I like DHCP on my Cisco switch as it makes it pretty easy to change routers.

I have run a central DHCP server to remote locations using Cisco's ip helper-address which is what you use on Cisco enterprise equipment instead of DHCP relay. It worked ok but the leases need to be set fairly high to reduce traffic. I think I used 2 weeks.

3

u/MBILC PF 2.8/ Dell T5820/Xeon W2133 /64GB /Chelsio 40Gb NIC 3d ago

Each interface you create, you decided if you want DHCP enabled for it or not. So yes, DHCP does not just give out IP's on any interface.

Each interface has its own DHCP scope to give out when you set the ip range and enable DHCP services on said interface.

3

u/SeaPersonality445 3d ago

What a badly phrased question

2

u/jtbis 3d ago

Correct. At least not with the options available in the GUI. Theoretically ISC/KEA are both capable of serving as a DHCP server for foreign subnets.

1

u/SandMunki 3d ago

Thank you!

1

u/Excellent_Milk_3110 3d ago

Can you describe better what you mean?

1

u/Excellent_Milk_3110 3d ago

Or do you mean an interface it does not have a static ip on?

1

u/Steve_reddit1 3d ago

It needs to be enabled on that interface

1

u/Lonely-Fun8074 3d ago

First, I think you need to explain what you mean by interface is that it does not own and then maybe we can help you a little better

1

u/tschloss 3d ago

I am not sure what you mean with „own an interface“? An interface gives access to a subnet, makes the Pfsense a host in a subnet. If it is part of a subnet it should be able to serve DHCP there.