[CentOS] Centos 7 dhcpd failure to allow a 2nd network over same interal nic

Wed Jan 18 17:37:49 UTC 2017
Stuart Barkley <stuartb at 4gh.net>

On Mon, 16 Jan 2017 at 03:44 -0000, Rob Kampen wrote:

> On 16/01/17 17:12, James A. Peltier wrote:
> > VLANs are your friend, otherwise DHCPD is not going to understand how to
> > properly answer your request for different networks on the same interface.

Be careful about expecting VLANs to provide security.  VLANs are for
traffic management are not directly a security tool.  They might be
useful in a carefully designed security model.

> Here's an idea - untested.
> set up a network on the single nic - say 192.168.55.xx/24
> set up the dhcp to offer leases from a subset of this network - say
> set up fixed leases based upon mac address from the remainder of the network -
> i.e. outside the subset above - e.g.
> then route / firewall as required - i.e. trusted known mac address hence IP
> address allowed vs unknown guest given an IP address we can block or otherwise
> handle.
> As indicated, this is not tested but if memory serves, dhcpd will allow this
> kind of allocation.

I do something like this (although FreeBSD is my dhcp server) only I
do like the original proposal, two addresses on the DHCP server and
both subnets configured.  Part of my dhcp configuration includes:

    shared-network shared {
        # Primary subnet
        subnet netmask {
            option routers;
            max-lease-time 86400;
            default-lease-time 86400;


        # Secondary subnet
        subnet netmask {
            option routers;
            max-lease-time 86400;
            default-lease-time 86400;
    } # end of shared-network shared

    host ip-phone-1 {
        hardware ethernet 00:0b:82:xx:xx:xx;
        ## fixed-address;

There are other things necessary to make this all work.  I also have a
FreeBSD system acting as a router between the subnets and my ISP
connection.  I also have a caching dns service on both subnets (I
didn't include the dns related configuration in the example above).

As others have suggested, this also is NOT a security technique.  The
systems in each address space will have access to systems in the other
address space even without a router.  I don't distinguish between
trusted and untrusted networks, I assume all are untrusted and secure
the systems themselves as needed.

I've never been lost; I was once bewildered for three days, but never lost!
                                        --  Daniel Boone