# Plan the pfSense DHCP server-to-relay transition across all interfaces

> The relay cannot simply be enabled beside the existing local DHCP server.

- Canonical URL: https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:21+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The relay cannot simply be enabled beside the existing local DHCP server.

## Potentially affected

This concerns pfSense's DHCP relay implementation.

## DSE recommendation

DSE recommends inventorying every locally served subnet before moving to relay.

## Article

The relay cannot simply be enabled beside the existing local DHCP server.

## Source facts

Netgate states that pfSense cannot run its DHCP server and DHCP relay simultaneously; the server must first be disabled on all interfaces. The relay forwards client requests to configured upstream servers. In an HA design, a selected CARP VIP can control whether relay runs so backup and primary nodes do not send conflicting messages.

Source: [Netgate — DHCPv4 & DHCPv6 Relay](https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html).

## Applicability

This concerns pfSense’s DHCP relay implementation.

## DSE recommendation

DSE recommends inventorying every locally served subnet before moving to relay. Prepare the upstream scopes, addressing, gateway options, return routing, and availability plan before disabling local service. Identify all downstream interfaces that should relay and ensure excluded networks stay excluded. In HA, document the CARP status dependency rather than running independent uncoordinated relays. Keep the previous local configuration and a clear rollback point for clients that cannot renew. Build the cutover checklist around every interface that still serves local leases, including networks outside the initial pilot. Ask the address-management owner to validate upstream scopes before shutdown. In HA, require evidence from both active and standby roles rather than only a successful primary-node lease.

## Verification

During an approved migration rehearsal, obtain and renew a lease from each representative client subnet and confirm the responding server and assigned options. Inspect the relay’s interface selection and upstream target. For HA, exercise an authorized role change and verify that only the intended active node relays while clients can still acquire leases.

## Official reference

[Netgate — DHCPv4 & DHCPv6 Relay](https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — DHCPv4 & DHCPv6 Relay
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Plan the pfSense DHCP server-to-relay transition across all interfaces,” DSE Security, https://update.dsesecurity.com/updates/plan-the-pfsense-dhcp-server-to-relay-transition-across-all-interfaces/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.