DHCP Server¶
t1n1wall provides an integrated DHCP server using dnsmasq as the backend. The same dnsmasq instance serves both DNS forwarding and DHCP, which is why DNS forwarder and DHCP share some configuration interactions.
DHCP backend¶
The DHCP server uses dnsmasq (replaced ISC dhcpd in the FreeBSD 10 release). A single dnsmasq process handles DNS forwarding and DHCP on all configured interfaces simultaneously.
Web UI location¶
Services > DHCP Server
Select the interface tab (LAN, OPT1, etc.) to configure DHCP for that segment.
IPv4 DHCP configuration¶
Enable¶
Master toggle per interface. DHCP can be enabled independently on LAN and each optional interface.
Deny unknown clients¶
When enabled, the DHCP server only responds to clients whose MAC addresses appear in the static reservations list. Any device without a reservation is ignored.
Useful for controlled environments where only known hosts should receive addresses.
Address pool¶
| Field | Notes |
|---|---|
| Range start | First address DHCP will allocate dynamically |
| Range end | Last address DHCP will allocate dynamically |
The pool must fall within the interface subnet. Addresses reserved for static mappings should be outside the dynamic range.
Optional fields¶
| Field | Default | Notes |
|---|---|---|
| WINS servers | — | Primary and secondary WINS (Windows name resolution) |
| DNS servers | firewall IP | Blank = clients use the firewall as DNS; set if using an external resolver |
| Gateway | firewall IP | Blank = clients use the firewall as default gateway |
| Default lease time | 7200 s | Lease duration for clients that do not request a specific time |
| Max lease time | — | Upper bound; must be greater than default lease time |
| Next server | — | IP of PXE/TFTP boot server (requires filename) |
| Filename | — | Boot file on next server (requires next server IP) |
PXE boot¶
Set both Next server and Filename to enable PXE/network boot. The DHCP server will include next-server and filename options in its offers.
IPv6 DHCP configuration¶
IPv6 DHCP is configured on a separate tab within the same page. It operates independently of IPv4 DHCP.
| Field | Default | Notes |
|---|---|---|
| Enable IPv6 DHCP | Off | — |
| Range start | — | First IPv6 address to allocate |
| Range end | — | Last IPv6 address to allocate |
| Default lease time | 7200 s | — |
| Max lease time | — | Must exceed default |
Static reservations¶
Below the DHCP configuration, a table lists static MAC-to-IP mappings. Each reservation assigns a fixed IP to a specific MAC address, regardless of the dynamic pool.
- Add a reservation to guarantee a specific host always receives the same address
- Reservations outside the dynamic range are valid and recommended to avoid conflicts
- Required when Deny unknown clients is enabled
DNSSEC¶
dnsmasq performs DNSSEC validation when enabled on the DNS forwarder. This applies to all DNS queries processed by the same dnsmasq instance, including those from DHCP clients using the firewall as their resolver.
DNSSEC support was added in the FreeBSD 11 release.
Interactions¶
Captive portal¶
If captive portal is enabled on an interface, the DHCP server must also be enabled on that same interface. The DHCP max lease time must exceed the captive portal idle timeout to prevent lease expiry evicting active sessions.
DNS forwarder¶
When DNS servers are left blank in the DHCP configuration, clients receive the firewall's LAN address as their DNS server and queries are handled by the local DNS forwarder. This is the recommended default.
Setting explicit DNS servers overrides this and clients will query those servers directly, bypassing the firewall's DNS forwarder (including any IP Pool mappings).
DHCP leases¶
Active and recent DHCP leases are visible under Diagnostics > DHCP Leases.