Allowing specific IP addresses to receive DHCP offers requires configuring Windows Defender Firewall rules for UDP port 68. By default, the firewall may block incoming DHCP responses if strict inbound filtering is active or if a custom rule interferes with network stack communication. This guide details how to create precise exceptions for trusted DHCP servers while maintaining security.
Understanding DHCP Traffic and Firewall Interception
DHCP (Dynamic Host Configuration Protocol) relies on a client-server model where the client broadcasts a request and the server responds with an offer. The client listens on UDP port 68, while the server sends from UDP port 67. In modern Windows environments, Windows Defender Firewall typically allows this traffic by default under "Core Net" settings. However, issues arise when administrators apply hardened security profiles, use third-party security suites, or have previously created restrictive inbound rules that inadvertently drop these packets. When a specific IP address fails to obtain an IP configuration, it often results in an APIPA address (169.254.x.x), indicating the DHCP handshake failed. If you are managing a segmented network or a DMZ where only certain subnets should receive DHCP services, you must ensure the firewall permits these specific interactions. It is crucial to distinguish between blocking the initial broadcast (which is outbound from the client) and blocking the response (which is inbound). Most connectivity issues stem from the latter being filtered out by overly aggressive inbound policies. For more context on how firewall settings interact with network adapters during installation or updates, you might find Windows 11 23H2 Installation: Firewall Drops DHCP, Reaktek 2.5GbE 8125 Adapter Connection Issues helpful, as it discusses similar adapter-level firewall conflicts.Verifying Default Firewall Behavior
Before creating new rules, verify whether existing rules are causing the conflict. Open the Windows Defender Firewall with Advanced Security console. Navigate to Inbound Rules and look for rules related to "File and Printer Sharing" or "Core Networking." Specifically, check for a rule named "File and Printer Sharing (Echo Request - ICMPv4-In)" which is unrelated, but more importantly, look for rules governing "DHCP Client." The standard rule that allows DHCP responses is usually titled "File and Printer Sharing (Echo Request - ICMPv4-In)" is incorrect; the correct one is often implicit in the "Network Discovery" or "Remote Event Log Management" profiles, but explicitly, there is no single rule named "DHCP Server" on the client side because the client does not listen on port 67. Instead, the client's ability to receive on port 68 is governed by the general "Public," "Private," and "Domain" profile settings. If your network profile is set to Public, Windows applies stricter filtering. Ensure your network location is correctly identified as Private or Domain. You can change this via Settings > Network & Internet > Ethernet (or Wi-Fi) > Properties. Setting it to Private allows most local subnet communications, including DHCP, without explicit rule creation. If you suspect a specific rule is blocking the traffic, you can disable rules temporarily to test. Right-click a suspicious inbound rule and select Disable Rule. Test the connection immediately after disabling. If the IP address is obtained successfully, that rule was the culprit. Remember to re-enable it afterward and modify its scope instead of leaving it disabled permanently.Creating a Specific Inbound Rule for UDP Port 68
If the default behavior is insufficient or if you need to allow DHCP offers from a specific remote server IP that is not on the local subnet, you must create a custom inbound rule. This approach provides granular control over which source IPs can send DHCP responses to your machine. Open the Windows Defender Firewall with Advanced Security. Click on Inbound Rules in the left pane, then select New Rule in the right action pane. In the Rule Type window, select Port and click Next. In the Protocols and Ports window, choose UDP for the protocol type. Enter 68 in the Specific local ports field. Click Next. In the Action window, select Allow the connection and click Next. In the Profile window, select the appropriate network profiles (Domain, Private, Public) depending on where this rule should apply. Typically, selecting all three ensures coverage, but restricting it to Private or Domain is safer for production environments. Click Next. In the Name window, provide a descriptive name such as "Allow DHCP Server Response from Specific IP." Add a description like "Permits UDP port 68 input from trusted DHCP server." Click Finish. Once the rule is created, you must edit it to restrict the scope to specific IP addresses. Double-click the newly created rule. Go to the Scope tab. Under Remote IP addresses, select These IP addresses. Click Add and enter the specific IP address of the DHCP server you wish to allow. For example, if your DHCP server is at 192.168.1.10, add that exact address. You can also use a subnet mask if multiple servers exist within a range, but entering specific IPs is more secure. Click OK to save the changes. This rule will now permit incoming UDP packets on port 68 only from the specified source, ignoring requests from any other IP address.Troubleshooting and Validation
After applying the rule, validate the configuration using command-line tools. Open Command Prompt as Administrator and runipconfig /release followed by ipconfig /renew. Observe the output. If successful, you will see a new IPv4 address assigned. If it fails, check the event viewer for DHCP client errors. Look under Applications and Services Logs > Microsoft > Windows > DHCP-Client.
You can also use netsh to verify the rule status. Run netsh advfirewall firewall show rule name="Allow DHCP Server Response from Specific IP" to confirm the rule exists and has the correct parameters. Additionally, consider checking if your antivirus software has its own firewall module that might override Windows Defender settings. Many third-party security suites have their own "Network Protection" features that require separate configuration to allow DHCP traffic. If you are experiencing persistent issues despite correct firewall rules, consult Understanding Default Network Settings in Windows Defender Firewall to understand baseline behaviors that might be interfering with your custom configurations.
Finally, ensure that the DHCP server itself is configured to respond to requests from the client's MAC address or IP range. While the firewall issue is on the client side, server-side restrictions can also cause failures. Verify that the server's lease database includes the client or is willing to assign a new lease. If the client receives an offer but cannot accept it due to other network constraints, the problem lies outside the firewall rule.