To resolve DHCP conflicts when using a DD-WRT router as a wireless access point with OPNsense, disable the DHCP server on the DD-WRT unit and connect it exclusively via its LAN ports. This ensures that only the OPNsense firewall handles IP address assignment, preventing duplicate servers from causing network instability or device connection failures.
Understanding the Network Topology
When you integrate a third-party firmware router like DD-WRT into an existing network managed by a dedicated firewall such as OPNsense, the primary goal is to extend the wired and wireless coverage without creating a second routing domain. In this scenario, the DD-WRT device should function strictly as a Layer 2 switch and wireless access point, not as a router. If both devices attempt to assign IP addresses to clients, your network will suffer from what is known as a double NAT situation or, more critically in this case, conflicting DHCP services.
The OPNsense box acts as the central authority for your local subnet. It manages the Dynamic Host Configuration Protocol (DHCP) service, handing out unique IP addresses, subnet masks, default gateways, and DNS servers to all connected devices. The DD-WRT router, if left in its default configuration, also runs a DHCP server. When two devices broadcast DHCP offers on the same broadcast domain, client devices may receive conflicting information, leading to inability to connect, intermittent connectivity, or being assigned an IP address that cannot reach the internet.
Disabling the DHCP Server on DD-WRT
The first critical step is to prevent the DD-WRT router from acting as a DHCP server. You must log into the DD-WRT web interface using a computer that is currently connected to it, preferably via a wired Ethernet cable to avoid losing connectivity during the process. Navigate to the Setup tab in the main menu. Within this section, look for the Network Setup submenu.
In the Network Setup page, locate the setting labeled DHCP Server. You will see options to enable or disable this feature. Select Disable. Before saving, ensure that the static IP address you have assigned to the DD-WRT router itself remains within the same subnet as your OPNsense network but outside the DHCP lease range defined in OPNsense. For example, if your OPNsense DHCP range is 192.168.1.100 to 192.168.1.200, set the DD-WRT LAN IP to something like 192.168.1.2. This allows you to manage the DD-WRT device later while ensuring no conflict occurs with dynamically assigned client IPs. After making these changes, click Save and then Apply Settings.
Physical Connection and Port Configuration
Once the DHCP server is disabled, the physical cabling becomes the most important factor in maintaining a stable network. You must connect the OPNsense LAN port to one of the LAN ports on the DD-WRT router. Crucially, you must not use the WAN (Internet) port on the DD-WRT router for this connection. Using the WAN port would create a separate subnet behind the DD-WRT, isolating clients from the OPNsense management interface and potentially breaking inter-VLAN communication if you have complex routing rules.
If your DD-WRT model has multiple LAN ports, any of them can be used for the uplink to OPNsense. The remaining LAN ports on the DD-WRT will now act as simple switch ports, allowing you to connect other wired devices directly to the DD-WRT as if they were plugged into the OPNsense switch. The wireless radios on the DD-WRT will also bridge their traffic to the LAN side, allowing Wi-Fi clients to request IP addresses from the OPNsense DHCP server.
Verifying Wireless Settings
Ensure that the wireless settings on the DD-WRT are configured correctly. Go to the Wireless tab and verify that your SSID, security type (WPA2-PSK or WPA3), and password are set as desired. Since the DD-WRT is now just an access point, it does not need to handle routing; it simply encapsulates wireless frames and sends them to the LAN port where OPNsense can process them. Check that the wireless mode matches your hardware capabilities (e.g., 802.11ac/n) to ensure optimal performance.
Troubleshooting Common Issues
After completing the configuration, you may encounter issues where devices fail to obtain an IP address. First, reboot your client devices or release and renew their DHCP leases. On Windows, you can do this by opening a command prompt and running ipconfig /release followed by ipconfig /renew. On macOS or Linux, toggle the Wi-Fi off and on again.
If devices still do not get an IP, check the DHCP logs in the OPNsense interface. Navigate to Status > DHCP Leases to see if requests are coming through. If you see requests but no leases are issued, verify that the OPNsense DHCP service is enabled and that there are no reserved IPs blocking the range. Additionally, ensure that the DD-WRT firmware is updated to a stable version, as older builds sometimes have bugs related to bridge modes.
For further reading on managing IP assignments, you might find it useful to review how to configure specific DHCP rules for different segments, which can help if you plan to expand your network later. See How to Configure DHCP Server Rules to Assign Different IP Ranges for Different Racks. Also, if you experience intermittent connectivity after changing network hardware, checking for IP conflicts is a standard diagnostic step, similar to resolving conflicts caused by other network devices as discussed in How to Solve an IP Address Conflict Caused by a VPN Connection.
Frequently Asked Questions
Can I use the WAN port on the DD-WRT router?
No, you should never use the WAN port when connecting a DD-WRT router as a pure access point to another router. Using the WAN port creates a secondary subnet, which prevents devices connected to the DD-WRT from communicating directly with devices on the OPNsense network and breaks the single DHCP scope required for proper operation.
What happens if I forget to disable the DHCP server on DD-WRT?
If both the OPNsense and DD-WRT DHCP servers are active, your devices will receive conflicting IP configurations. This often results in devices being unable to access the internet, receiving APIPA addresses (like 169.254.x.x), or experiencing intermittent connectivity drops as they switch between responses from the two servers.
How do I access the DD-WRT admin panel after disabling DHCP?
You can still access the DD-WRT admin panel by connecting a computer directly to one of its LAN ports via Ethernet. Ensure your computer is set to obtain an IP automatically or manually assign one in the same subnet as the DD-WRT static IP. Then, open a browser and navigate to the static IP address you configured for the DD-WRT device.
Does this setup support VLANs?
Standard DD-WRT setups do not handle VLAN tagging as robustly as enterprise switches or OPNsense itself. If you require VLAN segmentation, it is best to handle VLAN creation and tagging on the OPNsense side and use managed switches or OPNsense interfaces to distribute traffic. The DD-WRT should remain untagged and bridge all traffic to the main LAN.
Why are my wireless clients getting slow speeds?
Slow speeds are rarely caused by the DHCP configuration itself. Instead, check the wireless channel selection on the DD-WRT to ensure it is not congested with neighboring networks. Also, verify that the DD-WRT firmware is up to date and that the wireless mode is set to match the capabilities of your client devices, avoiding legacy modes that throttle throughput.