TTR Networks

Beginner · Office gateway: DHCP, DNS and VRRP on VyOS · section 3 of 6

DHCP and DNS

✓ Lab-tested 18 October 2026 on VyOS 2026.10.16-0024-rolling

DHCP

Both routers run a DHCP server for the LAN, with the same options but separate halves of the pool: R1 hands out .100–.149 and R2 .150–.199. Two servers with overlapping pools would hand out the same address twice. Split pools are the simplest way to run two independent DHCP servers. (VyOS's Kea-based DHCP server also supports a proper high-availability pair, which shares the lease database instead.)

Every lease includes:

  • default-router 10.0.0.1: the VRRP address, never a router's own address.
  • name-server: the DNS servers (more on this below).
  • domain-name: so printer resolves as printer.office.example.
  • A static mapping for the printer: its MAC address always gets 10.0.0.20, from either server.

pc1 runs a DHCP client. It broadcasts a DISCOVER, both servers offer, and it takes the first offer, which here came from R2. It doesn't matter which: the gateway is the virtual address either way. pc2, the printer, gets its reserved 10.0.0.20.

DNS forwarding

Each router runs a DNS forwarder: it accepts queries from the LAN (allow-from), passes them to the ISP's resolver, and caches the answers. The first version hands out both routers' own addresses as DNS servers, which is a common setup, and it works: pc1 resolves server.example.net through R1 and fetches the page through the virtual gateway.

R1: DHCP and DNS forwarding (R2: range .150–.199, listens on .3)
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 subnet-id '1'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 option default-router '10.0.0.1'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 option name-server '10.0.0.2'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 option name-server '10.0.0.3'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 option domain-name 'office.example'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 range 0 start '10.0.0.100'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 range 0 stop '10.0.0.149'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 static-mapping PRINTER mac '02:00:00:00:00:02'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 static-mapping PRINTER ip-address '10.0.0.20'
set service dns forwarding listen-address '10.0.0.2'
set service dns forwarding allow-from '10.0.0.0/24'
set service dns forwarding name-server '192.0.2.53'
  • Line 2: The gateway handed out: the virtual address.
  • Lines 3–4: DNS servers: the first version uses both routers' own addresses.
  • Line 5: Search domain.
  • Lines 7–8: R1's half of the pool.
  • Lines 9–10: The printer always gets .20.
  • Lines 11–13: DNS forwarding: listen on R1's address, accept the LAN, forward to the ISP's resolver.
Clients get their addresses (real output)
root@pc1:~# dhclient -v eth0 2>&1 | grep -E "DHCP|bound"
Internet Systems Consortium DHCP Client 4.4.3-P1
DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
DHCPOFFER of 10.0.0.150 from 10.0.0.3
DHCPREQUEST for 10.0.0.150 on eth0 to 255.255.255.255 port 67
DHCPACK of 10.0.0.150 from 10.0.0.3
bound to 10.0.0.150 -- renewal in 42297 seconds.
root@pc1:~# ip -br addr show eth0
eth0@if13        UP             10.0.0.150/24
root@pc1:~# ip route
default via 10.0.0.1 dev eth0
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.150
root@pc1:~# cat /etc/resolv.conf
domain office.example
search office.example
nameserver 10.0.0.2
nameserver 10.0.0.3
root@pc2:~# dhclient eth0
root@pc2:~# ip -br addr show eth0
eth0@if14        UP             10.0.0.20/24
  • Lines 4–6: R2's offer arrived first.
  • Line 11: Gateway: the virtual address.
  • Lines 16–17: DNS: both routers' own addresses.
  • Line 20: The printer's reservation.
Who handed out what (real output)
vyos@R1:~$ show dhcp server leases
IP Address    MAC address    State    Lease start    Lease expiration    Remaining    Pool    Hostname    Origin
------------  -------------  -------  -------------  ------------------  -----------  ------  ----------  --------
vyos@R2:~$ show dhcp server leases
IP Address    MAC address        State    Lease start          Lease expiration     Remaining    Pool    Hostname    Origin
------------  -----------------  -------  -------------------  -------------------  -----------  ------  ----------  --------
10.0.0.20     02:00:00:00:00:02  active   2026-10-17 14:00:36  2026-10-18 14:00:36  23:59:49     LAN     printer     local
10.0.0.150    02:00:00:00:00:01  active   2026-10-17 14:00:17  2026-10-18 14:00:17  23:59:30     LAN     lab         local
  • Lines 2–3: R1 gave out nothing: R2 answered first both times.
  • Line 7: The printer, from the static mapping.
  • Line 8: pc1, from R2's half.
DNS and web through the gateway (real output)
root@pc1:~# dig server.example.net +noall +answer +stats | grep -E "IN|SERVER"
server.example.net.	1	IN	A	192.0.2.80
;; SERVER: 10.0.0.2#53(10.0.0.2) (UDP)
root@pc1:~# curl -sS -m 5 http://server.example.net/
hello from server.example.net
  • Line 3: Answered by R1's forwarder.
  • Line 5: Fetched through the virtual gateway.