Setting up a DHCP server with isc-dhcp-server on Fedora

Dynamic Host Configuration Protocol (DHCP) automates IPv4 address allocation and distributes gateway and DNS settings. ISC DHCP provides controlled scopes, leases and fixed assignments for clients that join a local network.

This guide covers a single Fedora server for an internal IPv4 network, including configuration, firewall access and testing. It also accounts for Australian deployments, where NBN-connected premises in Sydney, Melbourne and Brisbane may already receive DHCP from an ISP router.

Use a wired test host with console access before altering a live network. For related command-line and systemd reference material, the Linux server guides can help you interpret the commands used below.

Preparing the Fedora DHCP host

Fedora usually publishes ISC DHCP as dhcp-server; older documentation may call the upstream package isc-dhcp-server. Check the available package, then install it:

dnf list --available '*dhcp-server*'
sudo dnf install dhcp-server

If your repository provides isc-dhcp-server, install that name instead. Both provide the dhcpd daemon and Fedora’s standard /etc/dhcp/dhcpd.conf configuration path.

Select a wired interface and give the server a static address, rather than obtaining it from another DHCP server. This example uses 192.168.50.10/24 and gateway 192.168.50.1. Replace LAN-LINK with the NetworkManager profile shown by nmcli:

ip -br link
nmcli connection show
sudo nmcli connection modify LAN-LINK ipv4.method manual ipv4.addresses 192.168.50.10/24 ipv4.gateway 192.168.50.1

SELinux normally permits dhcpd to read /etc/dhcp/dhcpd.conf and bind its socket. Keep the file in /etc/dhcp; moving it into a home directory can cause labelling errors.

Designing a safe IPv4 scope

The example network is 192.168.50.0/24. Reserve 192.168.50.1 for the router, 192.168.50.10 for the Fedora server and 192.168.50.100-199 for dynamic leases. This leaves space for infrastructure and static reservations without overlap.

Use short leases for frequently changing devices and longer leases for laptops connected overnight. A 10-minute default and two-hour maximum suit a managed office; 24 hours suits stable equipment. Very short timeouts can disrupt clients during network transitions.

Before starting, disable another DHCP server or move its pool. Competing servers can issue conflicting addresses and cause intermittent gateway or DNS failures. Use a DHCP relay for a remote subnet; one office LAN needs only the local server.

Writing the DHCP configuration

Back up the packaged file, then create a scope matching the interface:

sudo cp -a /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf.bak

authoritative;
default-lease-time 600;
max-lease-time 7200;

option domain-name "lan.example.com";
option domain-name-servers 1.1.1.1 9.9.9.9;

subnet 192.168.50.0 netmask 255.255.255.0 {
    range 192.168.50.100 192.168.50.199;
    option routers 192.168.50.1;
    option broadcast-address 192.168.50.255;
    option subnet-mask 255.255.255.0;
}

The subnet statement defines the scope and range limits dynamic allocation. The option statements supply the gateway, resolvers, subnet mask and broadcast address. Replace the sample domain and DNS servers with approved local values.

Omit authoritative; while another DHCP server remains active. After saving, validate the syntax before opening UDP port 67.

Opening the firewall and starting dhcpd

If firewalld is active, find the LAN interface’s zone and add UDP port 67 to it. Replace public below with the actual zone:

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --permanent --zone=public --add-port=67/udp
sudo firewall-cmd --reload

Validate the syntax, then start and persist the daemon:

sudo dhcpd -t -cf /etc/dhcp/dhcpd.conf
sudo systemctl enable --now dhcpd
systemctl status dhcpd --no-pager

A server behind another router needs a DHCP relay pointing to its LAN address. Broadcasts do not cross routers, and UDP port 67 must never be forwarded indiscriminately from the internet.

Verifying leases and client access

Reconnect or renew one test client, then inspect its IPv4 settings:

nmcli -f IP4.ADDRESS,IP4.GATEWAY,IP4.DNS device show

The client should receive an address from the pool, the configured gateway and both DNS resolvers. The log records DHCPDISCOVER, DHCPOFFER, DHCPREQUEST and DHCPACK:

sudo journalctl -u dhcpd -f
sudo tail -f /var/lib/dhcpd/dhcpd.leases

A 169.254.x.x address means no usable lease. Check the VLAN, server address, UDP firewall rule and competing ISP router DHCP. A valid lease with the wrong gateway or resolver usually indicates an incorrect option.

Adding reservations for Australian sites

Create fixed assignments for servers, printers or managed laptops using their MAC addresses. Keep them outside the dynamic range:

host admin-laptop {
    hardware ethernet 00:11:22:33:44:55;
    fixed-address 192.168.50.20;
}

Australian offices commonly mix Windows, macOS, Linux, Android and iOS devices, so standard DHCP options give the best compatibility. A common local custom is separating guest Wi-Fi from staff devices; use another scope or VLAN.

Sydney, Melbourne and Brisbane premises may use NBN Enterprise, business fibre or fixed wireless, often behind ISP equipment with DHCP enabled. AARNET-connected universities still require private IPv4 scopes internally. Document the gateway, pool, DNS policy and reservations before deployment.

Rolling out with a controlled first lease

Stage the server on an isolated segment with console access and retain a rollback path. Standardise the scope and reservation format across sites, then monitor the journal and lease file for failed requests or exhausted pools.

The immediate next step is to run sudo systemctl restart dhcpd on the staged host and confirm that the next test lease falls within 192.168.50.100-199.