VLAN interface addressing and DHCP — IPs, scopes, and what listens

A VLAN without addressing is a Layer 2 segment with no Layer 3 presence. A VLAN without DHCP is one where every host must be configured manually. This lesson covers IPv4 and IPv6 addressing on a VLAN interface, the DHCP scope per VLAN, the role of the firewall as the gateway for every directly attached subnet, and the production failure modes that arise when any of these are misconfigured.

The VLAN definition was the previous lesson. This lesson covers what the operator does once the VLAN exists as a logical interface.

IPv4 addressing on a VLAN

Every VLAN interface that participates in routing needs an IPv4 address. The address is the gateway for every host on that VLAN.

In the GUI: Interfaces → OPT1 → Static IPv4 address. Fill in:

• IPv4 address: the firewall’s IP on the VLAN (e.g. 192.0.2.1).
• Subnet mask: the prefix length as a mask (e.g. /24 shown as 255.255.255.0).

The convention: pick a low, memorable address (.1) so operators type it correctly under pressure. The address is the destination for every packet from hosts on the VLAN that is going off-subnet.

$ ifconfig igb1_vlan10 | grep -E 'inet|vlan|parent'

	inet 192.0.2.1 netmask 0xffffff00 broadcast 192.0.2.255
vlan: 10 parent interface: igb1

The three things to verify: the IP, the mask (which determines the subnet size), and the broadcast. If any one is wrong, the VLAN has either the wrong subnet or an unreachable gateway.

IPv6 addressing on a VLAN

IPv6 on a VLAN is more nuanced because there are three addressing modes:

1. Static. The operator assigns a static IPv6 address to the firewall on the VLAN. Common for point-to-point links and dedicated subnets.
2. SLAAC. The firewall sends Router Advertisements (RAs); hosts autoconfigure their IPv6 addresses from the advertised prefix. The firewall still has its own IPv6 address on the link.
3. DHCPv6. Stateful DHCPv6 assigns IPv6 addresses from a pool, with the firewall providing DNS and other options. Often used alongside SLAAC for stateless configuration.

In the GUI: Interfaces → OPT1 → IPv6 Configuration. Choose:

• Static IPv6 address. The manual address (e.g. 2001:db8:1::1/64).
• Track interface. The firewall’s IPv6 address is derived from a prefix delegated to the WAN interface. Common for residential ISP connections.
• Disable. No IPv6 on the VLAN.

The production default: configure both IPv4 and IPv6 on every VLAN that carries user or server traffic. A firewall that runs IPv4 only on a VLAN forces the VLAN’s hosts onto IPv4-only, which complicates DNS, monitoring, and integration with cloud services that prefer IPv6.

Running a DHCP scope per VLAN

Every VLAN that carries user devices, workstations, or BYOD clients needs a DHCP scope. The scope tells hosts what IP to use, what gateway to point at, what DNS servers to query, and how long the lease is valid.

In the GUI: Services → DHCPv4 → OPT1 (the menu path is per-VLAN; OPNsense treats each VLAN as a separate DHCP scope).

Fill in:

• Enable: yes.
• Range: from-to, e.g. 192.0.2.100 to 192.0.2.200. Leave a static range outside the pool for servers, printers, infrastructure.
• Gateway: the firewall’s IP on the VLAN (e.g. 192.0.2.1). Defaults to the interface IP — verify.
• DNS servers: the firewall’s IP (so hosts use OPNsense’s Unbound) or upstream resolvers if Unbound is disabled on the VLAN.
• Lease time: typically 1 hour for guest WiFi, 12-24 hours for user VLANs, longer for stable networks. Long leases mean fewer renewals but slower reallocation after a host leaves.

The DHCP service on OPNsense binds to the VLAN interface and listens for DHCP discovery broadcasts. The kernel passes DHCP broadcasts to the DHCP daemon because the firewall IP on the VLAN is the only IP that should respond to DHCP discovery on that subnet.

$ tcpdump -nei igb1_vlan10 -c 4 port 67 or port 68

12:34:56.789012 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from aa:bb:cc:11:22:33, length 300
12:34:56.789345 192.0.2.1.67 > 192.0.2.100.68: BOOTP/DHCP, Reply, length 300
12:35:00.123456 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from dd:ee:ff:00:11:22, length 300
12:35:00.123789 192.0.2.1.67 > 192.0.2.101.68: BOOTP/DHCP, Reply, length 300

The DHCP exchange is broadcast-based by design: the host does not yet have an IP, so it broadcasts the discovery. The firewall’s DHCP daemon is the only thing on the subnet that should respond. If the capture shows no reply, three things to check:

1. Is the DHCP service enabled on the VLAN?
2. Is there a firewall rule blocking DHCP from the VLAN to the firewall IP?
3. Is the DHCP daemon actually running?

Static mappings and reservations

Some hosts on a VLAN must have a stable IP — servers, printers, infrastructure. OPNsense supports static DHCP mappings: the operator adds an entry under Services → DHCPv4 → OPT1 → Static mappings that binds a MAC address to a specific IP. The IP is outside the dynamic pool.

The pattern: reserve the bottom of the subnet (.1 through .50 or so) for static mappings, leave the middle for dynamic pool, and reserve the top for special use (network equipment, future expansion).

$ tail -5 /var/log/dhcpd/latest.log

Aug 14 03:12:14 fw dhcpd: DHCPACK on 192.0.2.100 to aa:bb:cc:11:22:33 (laptop-01) via igb1_vlan10
Aug 14 03:12:14 fw dhcpd: DHCPREQUEST for 192.0.2.100 from aa:bb:cc:11:22:33 (laptop-01) via igb1_vlan10
Aug 14 03:12:33 fw dhcpd: DHCPOFFER on 192.0.2.101 to dd:ee:ff:00:11:22 via igb1_vlan10
Aug 14 03:12:34 fw dhcpd: DHCPACK on 192.0.2.101 to dd:ee:ff:00:11:22 via igb1_vlan10
Aug 14 03:14:01 fw dhcpd: DHCPRELEASE of 192.0.2.150 from 66:77:88:99:aa:bb (printer-01) via igb1_vlan10

The firewall as gateway

The firewall IP on a VLAN is the default gateway for every host on that VLAN. When a host wants to reach an IP off its subnet, it ARPs the gateway IP and sends the packet to the firewall’s MAC. The firewall then makes the routing decision.

This means the firewall is on the path of every off-subnet packet. A slow firewall is felt by every user; a misconfigured firewall rule blocks every user. The firewall’s role as gateway is the architectural reason firewall operators have to understand performance, offload, and rule evaluation in depth.

Common addressing and DHCP failures

Three production failure modes recur.

Failure 1: Wrong gateway IP

The DHCP scope’s gateway is configured to a different IP than the firewall’s actual VLAN IP. Hosts receive a DHCP lease with the wrong gateway and cannot reach the Internet.

The diagnostic: ifconfig on the firewall shows inet 192.0.2.1, but cat /var/dhcpd/etc/dhcpd.conf shows option routers 192.0.2.254. The two do not match.

The fix: align the gateway in the DHCP scope with the firewall’s actual VLAN IP.

Failure 2: Pool exhaustion

The DHCP pool is too small for the number of hosts on the VLAN. Hosts that request a lease when the pool is full receive DHCPNAK and cannot get an address.

The diagnostic: the dhcpd log shows no free leases or pool exhausted. The fix: widen the pool or shorten the lease time. Long leases (24 hours) on a small pool (50 addresses) for a high-churn environment (guest WiFi) will exhaust quickly.

Failure 3: DHCP blocked by firewall rule

The VLAN rules do not permit DHCP from hosts to the firewall IP. DHCP discovery is UDP from port 68 to port 67; the firewall rule must allow UDP from the VLAN to the firewall IP on port 67.

The diagnostic: tcpdump shows the DISCOVER but no OFFER. The fix: add a rule permitting UDP from the VLAN to the firewall IP on port 67, with logging to verify the rule matches.

Summary

• Every VLAN interface has an IPv4 (and ideally IPv6) address. The address is the gateway for every host on the VLAN.
• DHCP runs per-VLAN. The scope defines the pool, gateway, DNS, and lease time. Static mappings reserve IPs outside the pool.
• The firewall is the gateway for every directly attached VLAN. The firewall is on the path of every off-subnet packet.
• Three failure modes recur: wrong gateway IP, pool exhaustion, and DHCP blocked by firewall rules.