Plan the pfSense DHCP server-to-relay transition across all interfaces

The relay cannot simply be enabled beside the existing local DHCP server.

Source facts

Netgate states that pfSense cannot run its DHCP server and DHCP relay simultaneously; the server must first be disabled on all interfaces. The relay forwards client requests to configured upstream servers. In an HA design, a selected CARP VIP can control whether relay runs so backup and primary nodes do not send conflicting messages.

Source: Netgate — DHCPv4 & DHCPv6 Relay.

Applicability

This concerns pfSense’s DHCP relay implementation.

DSE recommendation

DSE recommends inventorying every locally served subnet before moving to relay. Prepare the upstream scopes, addressing, gateway options, return routing, and availability plan before disabling local service. Identify all downstream interfaces that should relay and ensure excluded networks stay excluded. In HA, document the CARP status dependency rather than running independent uncoordinated relays. Keep the previous local configuration and a clear rollback point for clients that cannot renew. Build the cutover checklist around every interface that still serves local leases, including networks outside the initial pilot. Ask the address-management owner to validate upstream scopes before shutdown. In HA, require evidence from both active and standby roles rather than only a successful primary-node lease.

Verification

During an approved migration rehearsal, obtain and renew a lease from each representative client subnet and confirm the responding server and assigned options. Inspect the relay’s interface selection and upstream target. For HA, exercise an authorized role change and verify that only the intended active node relays while clients can still acquire leases.

Official reference

Netgate — DHCPv4 & DHCPv6 Relay. Reviewed October 20, 2026.