| Read more about this book |
pfSense is an open source distribution of FreeBSD-based firewall which provides a platform for flexible and powerful routing and firewalling. The versatility of pfSense presents us with a wide array of configuration options.
In this article by Matt Williamson, author of pfSense 2 Cookbook, we will cover:
- Configuring the DHCP server
- Creating static DHCP mappings
- Configuring the DHCP relay
- Specifying alternate DNS servers
- Configuring the DNS forwarder
- Configuring a standalone DHCP/DNS server
- Configuring dynamic DNS
(For more resources on this subject, see here.)
Configuring the DHCP server
This recipe describes how to configure the DHCP service in pfSense. The DHCP service assigns an IP address to any client who requests one.
Getting ready
PfSense can only be configured as a DHCP server for interfaces configured with a static IP address. Using the examples in this article, that includes the LAN and DMZ interfaces but not the WAN. This example recipe will configure the DHCP server for your DMZ interface.
How to do it…
- Browse to Services DHCP Server|.
- Choose the DMZ tab.
- Check Enable DHCP server on DMZ interface:
(Move the mouse over the image to enlarge it.)
- Choose a Range of IP addresses for DHCP clients to use. This range must be contiguous and within the Available range listed above the Range:
- Save the changes and the DHCP service will be started.
- Apply the changes, if necessary.
How it works…
A DHCP server accepts requests from clients and assigns them an available IP address.
There’s more…
A DHCP server fulfills a client request by handing out the first available IP address. This means that it’s very likely that a client will receive a different IP address with every request.
In order to ensure that a client always receives the same IP address, we can create static DHCP mapping. See the next recipe, Creating static DHCP mappings, for more information.
Deny Unknown Clients
Enabling this option ensures that only clients with static DHCP mappings will receive an IP address. DHCP requests from all other clients will be ignored.
This is different from Enable static ARP entries where unknown clients will receive an IP address, although they won’t be able to communicate with the firewall (on that interface) in anyway.
DNS Servers
Specify any DNS server to be automatically assigned to our DHCP clients. If left blank, pfSense will automatically assign DNS servers to our clients in one of the following two ways:
- If DNS Forwarder is enabled, then the IP address of the interface is used. This is because the DNS Forwarder turns the pfSense machine itself into a DNS server, so the IP of the pfSense machine (that is, the gateway, which varies by interface) is assigned to each client.
- If DNS Forwarder isn’t enabled, then the DNS Servers configured on the General Setup page are used. And of course if, Allow DNS server list to be overridden by DHCP/PPP on WAN is enabled in General Setup, then the DNS servers obtained through the WAN will be used instead.
Gateway
The interface gateway will be provided to clients by default (that is, the static IP of the interface), but can be overridden here if necessary.
Domain Name
The domain name specified in General Setup is used by default, but an alternative can be specified here.
Default Lease Time
An alternative lease time can be specified here for clients who do not request a specific expiration time. The default is 7200 seconds.
Maximum Lease Time
An alternative maximum lease time can be specified for clients that ask for a specific expiration time. The default is 86400 seconds.
Failover Peer IP
CARP-configured systems can specify a fail-over IP address here.
Static ARP
Enabling static ARP entries will only allow clients with DHCP mappings to communicate with the firewall on this interface. Unknown clients will still receive an IP address, but all communication to the firewall will be blocked.
This is different from Deny Unknown Clients where unknown clients won’t even receive an IP address.
Dynamic DNS
Enable clients to automatically register with the Dynamic DNS domain specified.
Additional BOOTP/DHCP Options
Enter any custom DHCP option here. Visit http://www.iana.org/assignments/bootpdhcp- parameters/bootp-dhcp-parameters.xml for a list of options.
Creating static DHCP mappings
This recipe describes how to add static DHCP mappings in pfSense. A static DHCP mapping ensures a client is always given the same IP address.
Getting ready
Creating static DHCP mappings is only applicable for interfaces using the DHCP service.
How to do it…
- Browse to Status DHCP Leases| to view the list of clients who have issued DHCP requests.
- Click on the “plus” button to add a new static DHCP mapping.
- The MAC address will be pre-filled.
- Enter an IP address, which must be outside the range of dynamically assigned DHCP addresses.
- The Hostname may be pre-filled. If not, enter one.
- Enter a Description.
- Save the changes.
- Apply changes, if necessary. Scroll to the bottom of the DHCP Server page and verify that your new mapping exists.
How it works…
When a client connects to our DHCP server, the firewall first checks for a mapping. If the client’s MAC address matches a mapping we’ve specified, then the DHCP server uses the IP address specified in the mapping. If no mapping exists for our client’s MAC address, our DHCP server uses an IP address from its available range.
There’s more…
Static mappings can be viewed at the bottom of the DHCP Server configuration page for each interface by browsing to the Services DHCP Server | Interface| tab.
All static mappings for a given interface can be managed here. Existing mappings can be modified or removed, and new static mappings can be created, but you’ll have to enter the MAC address manually.
