{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/", "item": { "id": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/", "slug": "plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces", "url": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces.md", "json": "https://update.dsesecurity.com/api/v1/posts/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/" }, "title": "Plan the pfSense DHCP server-to-relay transition across all interfaces", "summary": "The relay cannot simply be enabled beside the existing local DHCP server.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:21+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 259, "potentially_affected": "This concerns pfSense's DHCP relay implementation.", "dse_recommendation": "DSE recommends inventorying every locally served subnet before moving to relay.", "primary_source": { "name": "Netgate — DHCPv4 & DHCPv6 Relay", "url": "https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

The relay cannot simply be enabled beside the existing local DHCP server.

\n

Source facts

\n

Netgate states that pfSense cannot run its DHCP server and DHCP relay simultaneously; the server must first be disabled on all interfaces. The relay forwards client requests to configured upstream servers. In an HA design, a selected CARP VIP can control whether relay runs so backup and primary nodes do not send conflicting messages.

\n

Source: Netgate — DHCPv4 & DHCPv6 Relay.

\n

Applicability

\n

This concerns pfSense’s DHCP relay implementation.

\n

DSE recommendation

\n

DSE recommends inventorying every locally served subnet before moving to relay. Prepare the upstream scopes, addressing, gateway options, return routing, and availability plan before disabling local service. Identify all downstream interfaces that should relay and ensure excluded networks stay excluded. In HA, document the CARP status dependency rather than running independent uncoordinated relays. Keep the previous local configuration and a clear rollback point for clients that cannot renew. Build the cutover checklist around every interface that still serves local leases, including networks outside the initial pilot. Ask the address-management owner to validate upstream scopes before shutdown. In HA, require evidence from both active and standby roles rather than only a successful primary-node lease.

\n

Verification

\n

During an approved migration rehearsal, obtain and renew a lease from each representative client subnet and confirm the responding server and assigned options. Inspect the relay’s interface selection and upstream target. For HA, exercise an authorized role change and verify that only the intended active node relays while clients can still acquire leases.

\n

Official reference

\n

Netgate — DHCPv4 & DHCPv6 Relay. Reviewed October 20, 2026.

", "content_text": "The relay cannot simply be enabled beside the existing local DHCP server.\nSource facts\nNetgate states that pfSense cannot run its DHCP server and DHCP relay simultaneously; the server must first be disabled on all interfaces. The relay forwards client requests to configured upstream servers. In an HA design, a selected CARP VIP can control whether relay runs so backup and primary nodes do not send conflicting messages.\nSource: Netgate — DHCPv4 & DHCPv6 Relay.\nApplicability\nThis concerns pfSense’s DHCP relay implementation.\nDSE recommendation\nDSE recommends inventorying every locally served subnet before moving to relay. Prepare the upstream scopes, addressing, gateway options, return routing, and availability plan before disabling local service. Identify all downstream interfaces that should relay and ensure excluded networks stay excluded. In HA, document the CARP status dependency rather than running independent uncoordinated relays. Keep the previous local configuration and a clear rollback point for clients that cannot renew. Build the cutover checklist around every interface that still serves local leases, including networks outside the initial pilot. Ask the address-management owner to validate upstream scopes before shutdown. In HA, require evidence from both active and standby roles rather than only a successful primary-node lease.\nVerification\nDuring an approved migration rehearsal, obtain and renew a lease from each representative client subnet and confirm the responding server and assigned options. Inspect the relay’s interface selection and upstream target. For HA, exercise an authorized role change and verify that only the intended active node relays while clients can still acquire leases.\nOfficial reference\nNetgate — DHCPv4 & DHCPv6 Relay. Reviewed October 20, 2026.", "content_markdown": "The relay cannot simply be enabled beside the existing local DHCP server.\n\n## Source facts\n\nNetgate states that pfSense cannot run its DHCP server and DHCP relay simultaneously; the server must first be disabled on all interfaces. The relay forwards client requests to configured upstream servers. In an HA design, a selected CARP VIP can control whether relay runs so backup and primary nodes do not send conflicting messages.\n\nSource: [Netgate — DHCPv4 & DHCPv6 Relay](https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html).\n\n## Applicability\n\nThis concerns pfSense’s DHCP relay implementation.\n\n## DSE recommendation\n\nDSE recommends inventorying every locally served subnet before moving to relay. Prepare the upstream scopes, addressing, gateway options, return routing, and availability plan before disabling local service. Identify all downstream interfaces that should relay and ensure excluded networks stay excluded. In HA, document the CARP status dependency rather than running independent uncoordinated relays. Keep the previous local configuration and a clear rollback point for clients that cannot renew. Build the cutover checklist around every interface that still serves local leases, including networks outside the initial pilot. Ask the address-management owner to validate upstream scopes before shutdown. In HA, require evidence from both active and standby roles rather than only a successful primary-node lease.\n\n## Verification\n\nDuring an approved migration rehearsal, obtain and renew a lease from each representative client subnet and confirm the responding server and assigned options. Inspect the relay’s interface selection and upstream target. For HA, exercise an authorized role change and verify that only the intended active node relays while clients can still acquire leases.\n\n## Official reference\n\n[Netgate — DHCPv4 & DHCPv6 Relay](https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/", "url": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Plan the pfSense DHCP server-to-relay transition across all interfaces", "item": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/#article", "identifier": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/", "url": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/", "headline": "Plan the pfSense DHCP server-to-relay transition across all interfaces", "description": "The relay cannot simply be enabled beside the existing local DHCP server.", "abstract": "The relay cannot simply be enabled beside the existing local DHCP server.", "articleBody": "The relay cannot simply be enabled beside the existing local DHCP server.\nSource facts\nNetgate states that pfSense cannot run its DHCP server and DHCP relay simultaneously; the server must first be disabled on all interfaces. The relay forwards client requests to configured upstream servers. In an HA design, a selected CARP VIP can control whether relay runs so backup and primary nodes do not send conflicting messages.\nSource: Netgate — DHCPv4 & DHCPv6 Relay.\nApplicability\nThis concerns pfSense’s DHCP relay implementation.\nDSE recommendation\nDSE recommends inventorying every locally served subnet before moving to relay. Prepare the upstream scopes, addressing, gateway options, return routing, and availability plan before disabling local service. Identify all downstream interfaces that should relay and ensure excluded networks stay excluded. In HA, document the CARP status dependency rather than running independent uncoordinated relays. Keep the previous local configuration and a clear rollback point for clients that cannot renew. Build the cutover checklist around every interface that still serves local leases, including networks outside the initial pilot. Ask the address-management owner to validate upstream scopes before shutdown. In HA, require evidence from both active and standby roles rather than only a successful primary-node lease.\nVerification\nDuring an approved migration rehearsal, obtain and renew a lease from each representative client subnet and confirm the responding server and assigned options. Inspect the relay’s interface selection and upstream target. For HA, exercise an authorized role change and verify that only the intended active node relays while clients can still acquire leases.\nOfficial reference\nNetgate — DHCPv4 & DHCPv6 Relay. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:21+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Plan the pfSense DHCP server-to-relay transition across all interfaces" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 259, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — DHCPv4 & DHCPv6 Relay", "url": "https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html" } } ] } }