Static and DHCP interface configuration

Every OPNsense interface needs an IP address and a subnet mask. Three addressing modes cover almost every production case: static (the operator enters the address manually), DHCP (the firewall asks the upstream for an address), and PPPoE (covered separately in the WAN section). This lesson covers the first two, plus the IPv4 alias feature that lets the operator put multiple addresses on a single interface.

Static IPv4

A static configuration is the operator’s choice when:

• The interface is on the LAN side and the address is part of the internal addressing plan.
• The ISP has assigned a fixed address (some business connections).
• The operator needs predictable addressing for firewall rules (e.g. the firewall is the gateway for a known subnet).

The configuration takes three values:

• IP address: e.g. 192.0.2.1.
• Subnet mask (CIDR prefix length): e.g. /24 for a 255.255.255.0 mask.
• Upstream gateway: only for upstream-facing interfaces (WAN). For LAN interfaces there is no upstream gateway.

OPNsense exposes the configuration under Interfaces → [name] → IPv4 Configuration Type: Static IPv4. After saving and applying, ifconfig shows the address on the interface.

$ ifconfig igb1

igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
  options=4e527bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWTSO,NETIF_TSO6,LRO6>
  ether a4:5e:60:dd:ee:fe
  inet 192.0.2.1 netmask 0xffffff00 broadcast 192.0.2.255
  inet 198.51.100.10 netmask 0xffffffff broadcast 198.51.100.10
  nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
  media: Ethernet autoselect (1000baseT <full-duplex>)
  status: active

DHCP client

When the upstream ISP hands out addresses via DHCP, the firewall’s WAN interface is configured as a DHCP client. The firewall’s dhclient sends a DHCPDISCOVER, the ISP’s server responds with a DHCPOFFER containing the address, lease time, default gateway, and DNS servers.

OPNsense exposes this under Interfaces → [name] → IPv4 Configuration Type: DHCP. The operator can optionally:

• Override the MTU if the ISP uses a non-standard MTU (some PPPoE deployments).
• Reject leases from specific upstream servers (rare).
• Configure a static route via DHCP for classless static routes (RFC 3442), used by some ISPs for subnet routing.

The DHCP client state is visible at Interfaces → [name] → DHCP lease status (in some versions) or by reading /var/db/dhclient.leases.<interface> at the shell.

IPv4 aliases (additional addresses)

A single physical interface can have multiple IP addresses. In OPNsense, additional addresses are called aliases and are configured under Firewall → Aliases. An alias can be:

• A single IP address (host alias).
• A network or subnet (network alias).
• A range of addresses (URL/table alias).
• A list of addresses (alias of multiple entries).

The alias is referenced in firewall rules by its name. The operator can use aliases to express “all servers in the DMZ”, “all IPs assigned to the public-facing firewall”, or “all addresses in the guest network”.

For IPv4 specifically, OPNsense also exposes interface aliases under Interfaces → [name] → IPv4 Aliases. These are additional IP addresses on the same interface, not in the alias table.

Configuring an IPv4 alias on the interface

For additional addresses on the same interface (e.g. a public IP block on the WAN, or a second subnet on the LAN), the operator navigates to Interfaces → [name] → IPv4 Aliases and adds entries. The format is IP/prefix per entry (e.g. 198.51.100.10/32).

After applying, ifconfig shows the alias as a second inet line, and the routing table has a host route for the alias pointing at the interface. PF matches inbound rules against the alias address as expected.

For ranges and networks, the alias table is the right tool — it can hold a /29, a /28, or a list of single addresses. The operator references the alias in rules.

$ route -n get 198.51.100.10

   route to: 198.51.100.10
destination: 198.51.100.10
     mask: 255.255.255.255
  gateway: 0.0.0.0
interface: igb1
    flags: <UP,HOST,DONE>
recvpipe  sendpipe  ssthresh  rtt,msec    mtu        expire
  0         0         0         0         1500        0

Verification workflow

After configuring an interface (static or DHCP) and any aliases, the operator verifies with three commands:

ifconfig <interface>     # confirm address is on the interface
route -n get <address>    # confirm route resolves correctly
ping <address>            # confirm the address is reachable

For a static LAN interface: ping 192.0.2.1 from the firewall’s diagnostic page confirms the address is on the interface. For a DHCP WAN: ping <isp_gateway> confirms the upstream is reachable. For an alias: ping <alias_ip> from inside the network confirms it is reachable.

Production patterns

Three patterns cover most cases:

1. LAN-side interfaces: static. The operator chooses the subnet and assigns the firewall the first or last addressable IP.
2. WAN with static IP from ISP: static. The operator enters the assigned IP, the ISP’s gateway, and the subnet mask (often /30 for a point-to-point).
3. WAN with DHCP from ISP: DHCP. The firewall obtains its address, gateway, and DNS from the ISP automatically.

Summary

• Three addressing modes: static, DHCP, PPPoE.
• Static: operator enters IP, mask, and upstream gateway manually.
• DHCP: firewall obtains address from upstream automatically.
• IPv4 aliases: additional addresses on the same interface.
• Verify with ifconfig, route -n get, and ping.