5 min read


pfSense 2 Cookbook

pfSense 2 Cookbook

A practical, example-driven guide to configuring even the most advanced features of pfSense 2.0

        Read more about this book      

pfSense is an open source distribution of FreeBSD-based firewall which provides a platform for flexible and powerful routing and firewalling. The versatility of pfSense presents us with a wide array of configuration options.

In this article by Matt Williamson, author of pfSense 2 Cookbook, we will cover:

  • Configuring the DHCP server
  • Creating static DHCP mappings
  • Configuring the DHCP relay
  • Specifying alternate DNS servers
  • Configuring the DNS forwarder
  • Configuring a standalone DHCP/DNS server
  • Configuring dynamic DNS

(For more resources on this subject, see here.)

Configuring the DHCP server

This recipe describes how to configure the DHCP service in pfSense. The DHCP service assigns an IP address to any client who requests one.

Getting ready

PfSense can only be configured as a DHCP server for interfaces configured with a static IP address. Using the examples in this article, that includes the LAN and DMZ interfaces but not the WAN. This example recipe will configure the DHCP server for your DMZ interface.

How to do it…

  1. Browse to Services DHCP Server|.
  2. Choose the DMZ tab.
  3. Check Enable DHCP server on DMZ interface:

    (Move the mouse over the image to enlarge it.)

  4. Choose a Range of IP addresses for DHCP clients to use. This range must be contiguous and within the Available range listed above the Range:

  5. Save the changes and the DHCP service will be started.
  6. Apply the changes, if necessary.

How it works…

A DHCP server accepts requests from clients and assigns them an available IP address.

There’s more…

A DHCP server fulfills a client request by handing out the first available IP address. This means that it’s very likely that a client will receive a different IP address with every request.

In order to ensure that a client always receives the same IP address, we can create static DHCP mapping. See the next recipe, Creating static DHCP mappings, for more information.

Deny Unknown Clients

Enabling this option ensures that only clients with static DHCP mappings will receive an IP address. DHCP requests from all other clients will be ignored.

This is different from Enable static ARP entries where unknown clients will receive an IP address, although they won’t be able to communicate with the firewall (on that interface) in anyway.

DNS Servers

Specify any DNS server to be automatically assigned to our DHCP clients. If left blank, pfSense will automatically assign DNS servers to our clients in one of the following two ways:

  • If DNS Forwarder is enabled, then the IP address of the interface is used. This is because the DNS Forwarder turns the pfSense machine itself into a DNS server, so the IP of the pfSense machine (that is, the gateway, which varies by interface) is assigned to each client.
  • If DNS Forwarder isn’t enabled, then the DNS Servers configured on the General Setup page are used. And of course if, Allow DNS server list to be overridden by DHCP/PPP on WAN is enabled in General Setup, then the DNS servers obtained through the WAN will be used instead.


The interface gateway will be provided to clients by default (that is, the static IP of the interface), but can be overridden here if necessary.

Domain Name

The domain name specified in General Setup is used by default, but an alternative can be specified here.

Default Lease Time

An alternative lease time can be specified here for clients who do not request a specific expiration time. The default is 7200 seconds.

Maximum Lease Time

An alternative maximum lease time can be specified for clients that ask for a specific expiration time. The default is 86400 seconds.

Failover Peer IP

CARP-configured systems can specify a fail-over IP address here.

Static ARP

Enabling static ARP entries will only allow clients with DHCP mappings to communicate with the firewall on this interface. Unknown clients will still receive an IP address, but all communication to the firewall will be blocked.
This is different from Deny Unknown Clients where unknown clients won’t even receive an IP address.

Dynamic DNS

Enable clients to automatically register with the Dynamic DNS domain specified.

Additional BOOTP/DHCP Options

Enter any custom DHCP option here. Visit http://www.iana.org/assignments/bootpdhcp- parameters/bootp-dhcp-parameters.xml for a list of options.

Creating static DHCP mappings

This recipe describes how to add static DHCP mappings in pfSense. A static DHCP mapping ensures a client is always given the same IP address.

Getting ready

Creating static DHCP mappings is only applicable for interfaces using the DHCP service.

How to do it…

  1. Browse to Status DHCP Leases| to view the list of clients who have issued DHCP requests.

  2. Click on the “plus” button to add a new static DHCP mapping.
  3. The MAC address will be pre-filled.
  4. Enter an IP address, which must be outside the range of dynamically assigned DHCP addresses.
  5. The Hostname may be pre-filled. If not, enter one.
  6. Enter a Description.

  7. Save the changes.
  8. Apply changes, if necessary. Scroll to the bottom of the DHCP Server page and verify that your new mapping exists.

How it works…

When a client connects to our DHCP server, the firewall first checks for a mapping. If the client’s MAC address matches a mapping we’ve specified, then the DHCP server uses the IP address specified in the mapping. If no mapping exists for our client’s MAC address, our DHCP server uses an IP address from its available range.

There’s more…

Static mappings can be viewed at the bottom of the DHCP Server configuration page for each interface by browsing to the Services DHCP Server | Interface| tab.

All static mappings for a given interface can be managed here. Existing mappings can be modified or removed, and new static mappings can be created, but you’ll have to enter the MAC address manually.

Subscribe to the weekly Packt Hub newsletter

* indicates required


Please enter your comment!
Please enter your name here