To extend DHCP services from a PfSense virtual machine to physical devices in an ESXi 7.0 environment, you must configure the PfSense firewall interface to listen on the correct VLAN or physical network segment and ensure the underlying vSwitch allows untagged traffic. This setup requires precise alignment between the virtual switch port group settings, the physical uplink configuration, and the PfSense DHCP server scopes to prevent address conflicts and routing failures.
Network Topology and Prerequisites
Before configuring software components, verify your physical and virtual network topology. The goal is to allow the PfSense VM, acting as the gateway, to hand out IP addresses to bare-metal machines connected to the same physical switch ports that host the ESXi management or data networks. Ensure that the physical switch ports connecting to the ESXi host are configured as access ports for the specific VLAN you intend to use, or as trunk ports if multiple VLANs are involved. If using a single flat network, ensure no other DHCP servers exist on that broadcast domain to avoid conflicts.
The ESXi host must have at least one standard virtual switch (vSwitch) or distributed switch with a port group that connects directly to the physical NIC carrying the traffic for these external devices. It is critical that this port group is not isolated from the physical uplink. In many default configurations, management traffic might be separated into its own VLAN, so you need a dedicated port group for the target devices. Verify that the physical switch port allows the traffic to pass through without filtering based on MAC addresses or other security features that might block the DHCP discovery packets.
Configuring the Virtual Switch Port Group
Navigate to the Networking section of the ESXi host via the web interface. Select the appropriate vSwitch and then the specific port group assigned to the physical devices. Click Edit Settings. Under the VLAN ID setting, enter the ID of the VLAN where your physical devices reside. If your network is unsegmented, leave this blank or set it to 0. Ensure that the Promiscuous Mode is set to Accept if the port group needs to see all traffic, although this is often not strictly required for DHCP if the gateway is correctly placed. More importantly, ensure that MAC Address Changes and Forged Transmits are accepted if you are dealing with dynamic MAC addresses from various client devices, though standard DHCP usually does not require these advanced security overrides unless specific bridging is involved.
PfSense Interface Configuration
Once the virtual infrastructure is ready, log into the PfSense web interface. Go to Interfaces > Assignments. You will see the available virtual network interfaces (e.g., vmx0, vmx1). Identify the interface corresponding to the port group created in ESXi. Assign this interface as the LAN or WAN depending on your design, but typically, the interface facing the physical clients should be designated as the internal or LAN interface. Save the changes and apply them. PfSense will restart the network services for that interface.
After assigning the interface, navigate to Interfaces > [Interface Name]. Here, you must enable the interface and assign a static IP address that serves as the default gateway for the DHCP clients. For example, if your subnet is 192.168.1.0/24, assign 192.168.1.1 to this interface. Ensure that the "Block private networks" option is unchecked if you want internal clients to communicate freely. Also, verify that the MTU settings match your physical network requirements, typically 1500 bytes for standard Ethernet.
Enabling the DHCP Server in PfSense
The core functionality lies in the DHCP server configuration within PfSense. Navigate to Services > DHCP Server. Scroll down to the section for the interface you just configured. Check the box to Enable DHCP server on this interface. Configure the range of IP addresses to lease. For instance, if your gateway is .1 and the subnet mask is /24, you might set the range from 192.168.1.100 to 192.168.1.200. Set the DNS servers to your preferred resolvers, such as 8.8.8.8 and 8.8.4.4, or your internal DNS if applicable. Save the settings.
It is crucial to understand that PfSense only responds to DHCP requests on interfaces where the DHCP server is explicitly enabled and where the interface has a valid IP address in the same subnet as the requested leases. If the DHCP request comes from a different VLAN or subnet, PfSense will ignore it unless you have configured relay agents or additional scopes, which is beyond the scope of basic extension. By enabling the server on the specific interface mapped to the physical switch's VLAN, PfSense becomes the authoritative DHCP source for that segment.
Firewall Rules and Verification
DHCP relies on UDP ports 67 and 68. PfSense’s default firewall rules usually allow DHCP traffic on the LAN interface, but it is wise to verify. Go to Firewall > Rules. Ensure there is an allow rule for DHCP on the interface facing the physical devices. If you have customized your firewall policies, make sure that the initial DHCP Discover and Offer packets are not blocked. These packets are broadcast messages, so they do not require a specific destination IP, but the firewall must permit the protocol itself.
To test the configuration, connect a physical device to the switch port associated with the ESXi host’s uplink. Set the device to obtain an IP address automatically. The device should receive an IP from the PfSense pool. You can verify this by checking the DHCP leases page in PfSense under Status > DHCP Leases. If the device does not get an IP, check the following: Is the physical switch port active? Is the VLAN tag correct on the ESXi port group? Is the PfSense interface actually up and showing the correct IP? If issues persist, consider reviewing Libvirt Guests on Isolated Network Cannot Ping Each Other for general isolation troubleshooting concepts, even though the hypervisor differs, the networking principles remain similar.
Troubleshooting Common Issues
If physical devices fail to acquire IPs, first check the physical layer. Ensure cables are connected and link lights are active. Next, verify the ESXi vSwitch configuration. A common mistake is creating a port group but failing to associate it with a physical NIC that has connectivity to the rest of the network. Another frequent error is VLAN mismatch; if the physical switch expects tagged traffic but the ESXi port group is untagged, the frames will be dropped. Use packet capture tools if available, or simply ping the gateway from another known-working device to ensure routing is functional.
Additionally, check for IP conflicts. If another router on the network is also handing out addresses, devices might pick the wrong gateway. Disable any other DHCP servers temporarily during testing. If you are moving existing devices, clear their DHCP cache or renew their lease. For more complex routing scenarios involving asymmetric paths, refer to Resolving Asymmetric Routing Issue in a Network with PfSense Router to ensure return traffic flows correctly through the PfSense firewall.
Frequently Asked Questions
Can I use the same vSwitch for management and client DHCP?
Yes, you can use the same vSwitch, but you should use different port groups with distinct VLAN IDs to separate traffic logically. This improves security and makes troubleshooting easier by isolating management traffic from user data traffic. Ensure the physical switch ports support the necessary VLAN tagging if you choose this approach.
Why do my physical devices still not get an IP after enabling DHCP in PfSense?
This is often due to firewall rules blocking the UDP ports 67 and 68 or incorrect VLAN configuration on the ESXi port group. Verify that the interface in PfSense is actually UP and has an IP address in the correct subnet. Also, check that the physical switch port is not blocking broadcast traffic.
Does this setup work with VMware Workstation or VirtualBox instead of ESXi?
The principles are similar, but the network configuration steps differ significantly. In desktop hypervisors, you typically configure NAT or Bridged adapters differently than in enterprise ESXi environments. For VirtualBox specific issues, see VirtualBox Guest with NAT and DHCP for Windows Networking.
What happens if the PfSense VM goes down?
If the PfSense VM crashes or is powered off, physical devices on that network segment will lose their ability to get new IP addresses and may lose connectivity if they cannot renew their leases. They might retain their current IP until the lease expires, but new devices will not connect. High availability solutions like CARP can mitigate this risk.
How do I handle multiple VLANs for different physical departments?
You need to create separate port groups in ESXi for each VLAN and assign the corresponding interface in PfSense. Then, enable the DHCP server on each respective interface in PfSense with unique IP ranges. This ensures that each department gets IPs from the correct subnet and follows its own routing policies.