pfSense: Static IP Mapping. Leases assigned based on MAC. Still pulling OTHER ADDRESSES!

I have bunch of devices on my IoT VLAN that I need to always have the same IP Address. But I don’t want to have to enter static IP addresses in each individual device. So within pfSense, I used the Static IP Mapping feature to assign IP Addresses based on the MAC addresses of each device. That was last night.

When I got up this morning, I found that the devices had renewed their old leases instead of using the new IP addresses per the mapping.

To try and force them to give up these unwanted addresses, I killed power to them all, used the “Clear IP Addresses” button to clear them all and changed the DHCP pool from which it draws new address to well above the highest address that has ever been used. The highest address that’s ever been used prior to making this last change: 10.1.20.229. I changed the pool range to 10.1.20.245 - 10.1.20.254.

After doing that, I restored power to two of these devices. I expected the fact that the leases had been cleared would cause them to ask for new addresses. That DID happen. BUT… The new addresses were still not per the mapping AND weren’t even within the pool range. The new addresses they received were 10.1.20.31 & 10.1.20.32. They’re SUPPOSED to be 10.1.20.13 & 10.1.20.15.

My next attempt at fixing this: I went into each device and assigned STATIC IP ADDRESSES for both that used the addresses I wanted them to use. Then I rebooted them and CLEARED ALL LEASES within pfSense again. Then I rebooted them. When they booted up, I was able to access them both using the desired IP addresses. I thought I had found a way to force them to drop the old addresses.

I went back and set them both to use DHCP because I want to manage all the addresses from within pfSense. When I did, they both grabbed NEW addresses that are AGAIN outside of the pool range: 10.1.20.33 and 10.1.20.34.

I’m beyond confused and frustrated.

Not really sure what you are doing wrong as I have not had any issues setting addresses in pfsense. Make sure you are putting the MAC address & the IP address in the proper space and under the proper tab for that network.

https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv4.html#static-mappings

The Static Mapping was setup Saturday night. Here is a screenshot showing one of the devices in question. They have the same MAC Address – I filtered the list by the MAC address. It pulled a new address this morning – notice the address is not within the pool range.

This is a screenshot of the DHCP Range for 10.1.20.0/24

This is the Static IP mapping assigned for this MAC address. The mapping was created by clicking on the little pencil next to the assigned lease. That took me a page with everything including the MAC address filled in except the IP Address. I entered the desired IP address and description. I was expecting the device to use that address the next time it got a new lease.

It appears the DHCP Server was behaving in a rogue manner. I killed power to all the offending devices, cleared all the leases again & rebooted pfSense. When it came back up, I confirmed there were no leases assigned other than those in the static mapping and restored power to the devices.

I kept an eye on the list of leases and nothing new showed up. I was able to browse to the proper IP Addresses of each device.

1 Like

Looks like you got it fixed.
If this comes up again, take a look at the arp cache on the pfsense box. When I’m moving devices to a new static IP, I’ll often delete both the dynamic DHCP lease and the associated arp entry to make sure that all traces of the old address are removed from the pfsense box. That might save you the reboot of your pfsense box.

Any chance you were using KEA DHCP? If so, I just ran into an issue where if you added a description into the Client Identifier field for the static mapping, then the client identifier field takes priority over the MAC address. In the past with ISC DHCP this was not the case and the MAC address took priority. I fixed my issue with KEA DHCP my leaving the client identifier field blank…then KEA looks only to the MAC address.