DHCP options 66, 67, 150, 43, and 82 — PXE, VoIP, vendor, and relay

Beyond the basics (IP, mask, gateway, DNS), DHCP carries dozens of vendor-specific options that clients use for boot configuration, vendor-specific setup, and identity. The five most commonly encountered in production are options 66 and 67 (PXE boot), option 150 (Cisco IP phones), option 43 (vendor-specific), and option 82 (relay agent information). Each has a specific use case, a specific encoding, and a specific failure mode.

This lesson covers what each option carries, how to configure it on OPNsense, and the production scenarios where each is the right tool.

The option numbering scheme

DHCP options are identified by a single-byte tag (1-254). The well-known options:

The format of each option depends on its type: IP addresses (4 bytes), integers (1-4 bytes), strings (N bytes, no NUL terminator), or nested sub-options (for vendor-specific).

Options 66 and 67 — PXE boot

PXE (Preboot Execution Environment) is the mechanism by which a network-bootable client downloads a bootstrap image from a TFTP server and boots from it. The DHCP server tells the client:

• Option 66 (TFTP Server Name): the hostname or IP of the TFTP server.
• Option 67 (Bootfile Name): the filename on the TFTP server to download.

The client combines these to download the boot image and boot from it. Common scenarios:

• Diskless workstations that boot from a central image server.
• OS deployment (FOG, MDT, Foreman, etc.) where the new OS image is fetched over PXE.
• Network-attached storage appliances that boot from a SAN or network image.

$ tcpdump -nei igb1 -vvv port 67

12:34:56.789012 0.0.0.0.68 > 255.255.255.255.67: DHCP, length 308
12:34:56.789012   message-type 1 (request)
12:34:56.789012   client-id option 1, length 7: ether aa:bb:cc:11:22:33
12:34:56.789012   requested-ip option 50, length 4: 192.168.1.50
12:34:56.789012   vendor-class option 60, length 9: "PXEClient"
12:34:56.789012   DHCP option 66, length 11: "192.168.1.20"
12:34:56.789012   DHCP option 67, length 22: "pxelinux/pxelinux.0"
12:34:56.789012   DHCP option 93, length 2: 6 0
12:34:56.789012   DHCP option 94, length 3: 6 0 0

Configuring options 66 and 67 in OPNsense:

1. Navigate to Services → DHCPv4 → [LAN].
2. Scroll to the “Additional BOOTP/DHCP options” section.
3. Add option 66 with the TFTP server IP.
4. Add option 67 with the bootfile path.

The options apply to every client on the scope. For PXE-specific configuration, the operator may want to limit the options to clients whose vendor class is “PXEClient” — this is done via DHCP classes in the GUI (Services → DHCPv4 → Classes).

Option 150 — Cisco IP phones

Cisco IP phones use option 150 (TFTP Server Address) to discover the TFTP server that hosts their configuration and firmware. The option carries the IP address(es) of the TFTP server(s).

Option 150 is similar to option 66 but:

• Option 66 is a string (hostname or IP).
• Option 150 is one or more IP addresses, encoded as a sequence of 4-byte fields.

Cisco IP phones prefer option 150 over option 66 when both are present. For a Cisco VoIP deployment, configure option 150 with the IP of the Cisco Unified Communications Manager (CUCM) TFTP server or a dedicated TFTP server.

Configuring option 150 in OPNsense follows the same pattern as options 66/67: add it as a custom option in the DHCP scope. The value is the IP address of the TFTP server.

Option 43 — vendor-specific information

Option 43 (Vendor Specific Information) is a generic container that vendors use to carry their own sub-options. The format:

[43 = [vendor-encapsulated-options]]

The inner options are encoded as [sub-option-code][length][data]. Each vendor defines its own sub-option space. Common uses:

• Cisco Aironet access points: option 43 carries the IP of the wireless LAN controller (WLC).
• Polycom / Yealink phones: option 43 carries the IP of the provisioning server.
• Various VoIP vendors: option 43 carries vendor-specific configuration.

Configuring option 43 in OPNsense requires encoding the vendor-specific sub-options. The format depends on the vendor. For example, for Cisco Aironet APs discovering a WLC:

option vendor-encapsulated-options 01:04:c0:a8:01:14;

Where:

• 01 is the sub-option code (vendor-specific, indicating WLC IP).
• 04 is the length (4 bytes for one IPv4 address).
• c0:a8:01:14 is the WLC’s IPv4 address (192.168.1.20).

The operator who configures option 43 must know the vendor-specific format for the device. There is no universal recipe.

Option 82 — relay agent information

Option 82 (Relay Agent Information) is added by a DHCP relay when it forwards a client’s request to a DHCP server. The option carries information about the relay:

• Sub-option 1 (Circuit ID): identifies the circuit (typically the VLAN ID or interface name on the relay).
• Sub-option 2 (Remote ID): identifies the remote host (typically the MAC of the relay’s interface or a configured identifier).

The DHCP server receives the request with option 82 and can use it to:

• Allocate a different scope based on the relay’s circuit ID (e.g. different subnet for different VLANs).
• Identify the originating segment in logs.
• Apply security policies (e.g. ignore requests with option 82 from untrusted relays).

Option 82 is a security feature: a DHCP server that enforces option 82 only responds to requests that came from a known relay. A rogue DHCP server on the LAN cannot spoof option 82 (because it does not see the original request through a relay).

OPNsense’s DHCP relay service can be configured to add option 82 to relayed requests. The format of the sub-options is configurable. For most production deployments, the relay adds sub-option 1 (circuit ID) with the VLAN ID and sub-option 2 (remote ID) with the relay’s MAC.

Capturing options on the wire

The verification pattern: capture a DHCP exchange and inspect the options.

# Capture DHCP on a LAN interface
tcpdump -nei igb1 -vvv port 67 or port 68

The -vvv flag prints each option with its tag, length, and value. The operator looking for option 66 sees:

DHCP option 66, length 11: "192.168.1.20"

If the option is missing or has the wrong value, the DHCP scope configuration is wrong.

Common options failure modes

Five failure modes appear repeatedly:

1. Option 66 with hostname instead of IP. Some clients cannot resolve the hostname. The client fails to download the boot image. Fix: use IP address, not hostname.

2. Wrong option 43 encoding. A byte off in the vendor-specific encoding means the device parses it as garbage. The device silently fails. Fix: verify the encoding with the vendor’s documentation.

3. Option 150 not configured for Cisco phones. The phone falls back to DHCP option 66 or fails to find the TFTP server. The phone does not register. Fix: configure option 150 with the TFTP server IP.

4. Option 82 stripping by intermediate relay. A relay that does not propagate option 82 (or strips it for “security”) prevents the DHCP server from seeing the circuit ID. The server leases from the wrong scope. Fix: verify option 82 is passed end-to-end.

5. Custom option with the wrong type. A custom option encoded as string when it should be IP address, or vice versa. The client parses it incorrectly. Fix: verify the option type with the RFC or vendor documentation.

Summary

• Option 66 (TFTP server name) and option 67 (bootfile name) drive PXE boot.
• Option 150 (TFTP server address, IP-encoded) drives Cisco IP phone configuration.
• Option 43 (vendor-specific) carries vendor-defined sub-options; the format is vendor-specific.
• Option 82 (relay agent information) carries the circuit ID and remote ID from the relay; the DHCP server uses it to select the right scope.
• Limit PXE options to PXE clients via DHCP classes.
• Verify options on the wire with tcpdump -vvv port 67.