LFCE 44 🐧 DHCP Server — dnsmasq as DHCP - KandZ

⏱️ Estimated read: 12 min | |

dnsmasq is a combined DNS forwarder and DHCP server designed for small networks. The previous chapters covered the ISC DHCP server, which is a dedicated daemon with a separate configuration file and a separate service. dnsmasq takes a different approach: one daemon, one configuration file, and one process that handles both DNS and DHCP. For a small office, a lab, or a home network, this consolidation reduces the number of moving parts. The DHCP configuration is written in the same /etc/dnsmasq.conf file that controls the DNS forwarding, and the leases are stored in a single file that can be inspected to see which clients have received addresses.

This chapter covers the DHCP-specific directives in dnsmasq: the dhcp-range that defines the address pool, the dhcp-host that reserves addresses for specific clients, the dhcp-option that delivers configuration to clients, and the lease file that records active assignments. It builds on the dnsmasq basics from the previous chapter; the DNS forwarding configuration is already in place, and this chapter adds the DHCP service that makes dnsmasq a complete small-network solution.

Key point: dnsmasq’s DHCP is disabled by default. It is enabled by adding a dhcp-range directive to /etc/dnsmasq.conf. The range defines the pool of addresses, and dnsmasq automatically sets the gateway and DNS server options to its own address unless they are overridden with dhcp-option directives. Static reservations use dhcp-host, and the lease file at /var/lib/misc/dnsmasq.leases records every active assignment.

Why dnsmasq’s DHCP model differs from ISC DHCP

The single-file problem.

ISC DHCP uses /etc/dhcp/dhcpd.conf for the DHCP configuration and a separate service. dnsmasq uses /etc/dnsmasq.conf for both DNS and DHCP. The DHCP directives are intermixed with the DNS directives, and the same --test command validates the entire configuration. This is simpler for a small network but less modular for a large one. The administrator does not need to manage two services or two configuration files, but the configuration file grows larger as both services are configured.

The default-option problem.

dnsmasq automatically sets the gateway and DNS server options to its own address when it serves DHCP. If the client should use dnsmasq as its DNS server and gateway, no dhcp-option directives are needed. If the gateway is a different device—a router, for example—the dhcp-option=option:router directive must override the default . This automatic behavior is convenient for a single-server network but requires explicit overrides when the network has separate DNS and routing devices.

The lease-integration problem.

dnsmasq registers the hostname of each DHCP client in its DNS cache automatically. A client that receives an address and reports its hostname becomes resolvable by that hostname from other clients on the network. ISC DHCP does not do this without additional configuration. The integration is a key reason dnsmasq is used as a combined DNS and DHCP service: the two functions share the same data .

a. Enabling DHCP with dhcp-range

The dhcp-range directive enables DHCP and defines the pool of addresses. The syntax is dhcp-range=<start>,<end>,<lease-time>. The lease time can be specified in seconds or with a suffix like 12h or 1d.

# /etc/dnsmasq.conf
# Enable DHCP with a pool of addresses and a 12-hour lease
dhcp-range=192.168.1.100,192.168.1.200,12h

# The interface can be specified to restrict DHCP to one NIC
dhcp-range=eth1,192.168.1.100,192.168.1.200,12h

The range must be on a subnet that dnsmasq is configured to serve. If the interface is specified, dnsmasq only offers addresses on that interface. Without the interface specification, dnsmasq listens on all interfaces that have a matching subnet . For a multi-homed host, the interface specification is necessary to prevent dnsmasq from offering addresses on the wrong network.

# Check the DHCP configuration syntax
sudo dnsmasq --test
# Output: dnsmasq: syntax check OK.

The --test flag validates the configuration without starting the daemon. It is the equivalent of dhcpd -t for ISC DHCP and should be run after every change .

b. Reservations with dhcp-host

The dhcp-host directive reserves an address for a specific client, identified by MAC address or hostname. The syntax is dhcp-host=<mac>,<ip>,<hostname>,<lease-time>. The IP address does not have to be inside the dynamic range, but it must be on the same subnet as a configured dhcp-range .

# Reserve an address for a printer
dhcp-host=00:11:22:33:44:55,192.168.1.50,printer,infinite

# Reserve an address for a server with a hostname
dhcp-host=aa:bb:cc:dd:ee:ff,192.168.1.10,fileserver,24h

The infinite lease time gives the client a lease that never expires. This is appropriate for infrastructure devices that should always have the same address. The hostname in the directive is registered in dnsmasq’s DNS cache, so the device becomes resolvable by name .

dnsmasq also supports reading host information from a file. The dhcp-hostsfile directive specifies a file containing one host per line, in the same format as the right-hand side of a dhcp-host directive. The file is re-read when dnsmasq receives a SIGHUP, which allows reservations to be added without restarting the service .

c. DHCP options and the lease file

The dhcp-option directive overrides the default options that dnsmasq sends to clients. The option can be specified by number or by name. The most common overrides are the gateway (option 3) and the DNS server (option 6).

# Override the default gateway (dnsmasq's own address is the default)
dhcp-option=option:router,192.168.1.254

# Override the DNS server (dnsmasq's own address is the default)
dhcp-option=option:dns-server,192.168.1.1,192.168.1.2

# Set the domain name
dhcp-option=option:domain-name,example.com

The default behavior is for dnsmasq to send its own address as the gateway and DNS server. If the network uses a separate router and separate DNS servers, these directives are required to override the defaults . The option names are defined in RFC 2132, and dnsmasq --help dhcp lists the names that dnsmasq recognizes.

The lease file records every active assignment. The default location is /var/lib/misc/dnsmasq.leases, though it can be changed with the dhcp-leasefile directive. Each line contains the lease expiry time, the MAC address, the IP address, the hostname, and the client ID .

# Inspect the lease file
cat /var/lib/misc/dnsmasq.leases
# Output: 1705310000 00:11:22:33:44:55 192.168.1.101 pc1 *

The first field is the expiry time in epoch seconds. The second is the MAC address, the third is the assigned IP, the fourth is the hostname (or * if unknown), and the fifth is the client ID (or * if the client did not provide one) . The lease file is updated as clients request and renew addresses.

Complete Example Session

# ============================================
# PART 1: ENABLE DHCP WITH A RANGE
# ============================================
sudo tee -a /etc/dnsmasq.conf > /dev/null <<'EOF'
dhcp-range=eth1,192.168.1.100,192.168.1.200,12h
EOF

# ============================================
# PART 2: OVERRIDE THE DEFAULT GATEWAY AND DNS
# ============================================
sudo tee -a /etc/dnsmasq.conf > /dev/null <<'EOF'
dhcp-option=option:router,192.168.1.254
dhcp-option=option:dns-server,192.168.1.1
dhcp-option=option:domain-name,example.com
EOF

# ============================================
# PART 3: ADD A STATIC RESERVATION
# ============================================
sudo tee -a /etc/dnsmasq.conf > /dev/null <<'EOF'
dhcp-host=00:11:22:33:44:55,192.168.1.50,printer,infinite
EOF

# ============================================
# PART 4: VALIDATE THE CONFIGURATION
# ============================================
sudo dnsmasq --test
# Output: dnsmasq: syntax check OK.

# ============================================
# PART 5: RESTART AND ENABLE THE SERVICE
# ============================================
sudo systemctl restart dnsmasq
sudo systemctl enable dnsmasq
sudo systemctl status dnsmasq

# ============================================
# PART 6: VERIFY DHCP IS LISTENING
# ============================================
sudo ss -ulnp | grep :67
# Output shows dnsmasq listening on UDP port 67

# ============================================
# PART 7: CHECK THE LEASE FILE
# ============================================
sudo cat /var/lib/misc/dnsmasq.leases
# Initially empty or contains leases from clients that have requested addresses

# ============================================
# PART 8: TEST WITH A CLIENT
# ============================================
# On a client on the 192.168.1.0/24 network:
# sudo dhclient -r eth0; sudo dhclient eth0
# Then check the client's address:
# ip addr show eth0

# ============================================
# PART 9: VERIFY THE RESERVATION IN THE LEASE FILE
# ============================================
# After the printer requests an address:
sudo grep "192.168.1.50" /var/lib/misc/dnsmasq.leases
# Output: <timestamp> 00:11:22:33:44:55 192.168.1.50 printer *

# ============================================
# PART 10: CHECK THE LOGS
# ============================================
sudo journalctl -u dnsmasq -n 20
# Output shows DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, DHCPACK

The ten parts demonstrate the complete dnsmasq DHCP configuration: enabling the range, overriding the default options, adding a reservation, validation, service restart, port verification, lease file inspection, client testing, reservation verification, and log inspection. The critical distinction from ISC DHCP is Part 2: dnsmasq sends its own address as the gateway by default, so the dhcp-option=option:router directive is required when a separate router exists.

Quick Reference

dnsmasq DHCP Directives

Directive	Purpose
`dhcp-range=<start>,<end>,<lease>`	Enable DHCP and define the pool
`dhcp-range=<if>,<start>,<end>,<lease>`	Restrict to one interface
`dhcp-host=<mac>,<ip>,<name>,<lease>`	Static reservation
`dhcp-host=<mac>,<ip>,infinite`	Reservation with infinite lease
`dhcp-option=option:router,<ip>`	Override default gateway
`dhcp-option=option:dns-server,<ip>`	Override default DNS server
`dhcp-option=option:domain-name,<name>`	Set domain name
`dhcp-hostsfile=<path>`	Read reservations from a file
`dhcp-leasefile=<path>`	Set lease file location

Default Behavior vs Override

Option	dnsmasq Default	Override Required
Gateway	dnsmasq’s own IP	`dhcp-option=option:router`
DNS server	dnsmasq’s own IP	`dhcp-option=option:dns-server`
Subnet mask	Interface’s mask	Usually correct
Lease time	From `dhcp-range`	—

Lease File Format

Field	Content	Example
1	Expiry time (epoch)	`1705310000`
2	MAC address	`00:11:22:33:44:55`
3	IP address	`192.168.1.101`
4	Hostname	`pc1` or `*`
5	Client ID	`*` or hex string

Best Practices

✅ Do This:

# Restrict DHCP to the internal interface
dhcp-range=eth1,192.168.1.100,192.168.1.200,12h               # ✅

# Override the gateway when a separate router exists
dhcp-option=option:router,192.168.1.254                       # ✅

# Use infinite leases for infrastructure devices
dhcp-host=00:11:22:33:44:55,192.168.1.50,printer,infinite     # ✅

# Validate before restarting
dnsmasq --test                                                # ✅

# Check the lease file after clients connect
cat /var/lib/misc/dnsmasq.leases                              # ✅

# Use dhcp-hostsfile for frequently changed reservations
dhcp-hostsfile=/etc/dnsmasq.d/reservations                    # ✅

❌ Don’t Do This:

# Enable DHCP without specifying the interface on a multi-homed host
dhcp-range=192.168.1.100,192.168.1.200,12h    # Listens everywhere # ❌

# Assume dnsmasq sends the router's address as the gateway
# It sends its own address unless overridden                     # ❌

# Place a reserved address inside the dynamic range
dhcp-range=192.168.1.50,192.168.1.200,12h    # Conflict with .50 # ❌

# Forget to validate after editing
systemctl restart dnsmasq    # Syntax error prevents start       # ❌

# Use a lease time that is too short for stable devices
dhcp-range=...,5m    # Clients renew constantly                 # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
DHCP not assigning addresses	`dhcp-range` missing or interface mismatch	Add `dhcp-range`; specify interface
Client gets wrong gateway	dnsmasq’s own address is the default	`dhcp-option=option:router,<router-ip>`
Client gets wrong DNS	dnsmasq’s own address is the default	`dhcp-option=option:dns-server,<dns-ip>`
Reservation not applied	MAC address mismatch	Verify the device’s MAC
Lease file empty	No clients have requested addresses	Expected; test with a client
Service fails to start	Port 53 conflict with `systemd-resolved`	Disable or reconfigure `systemd-resolved`

Real-World Examples

1. Basic DHCP range

dhcp-range=192.168.1.100,192.168.1.200,12h

2. Interface-restricted range

dhcp-range=eth1,192.168.1.100,192.168.1.200,12h

3. Static reservation

dhcp-host=00:11:22:33:44:55,192.168.1.50,printer,infinite

4. Override gateway

dhcp-option=option:router,192.168.1.254

5. Override DNS server

dhcp-option=option:dns-server,192.168.1.1,192.168.1.2

6. Set domain name

dhcp-option=option:domain-name,example.com

7. Validate configuration

dnsmasq --test

8. Check lease file

cat /var/lib/misc/dnsmasq.leases

9. Restart service

systemctl restart dnsmasq

10. Verify DHCP port

ss -ulnp | grep :67

Visual

dnsmasq DHCP Configuration Flow

┌──────────────────────────────────────────────────────────────┐
│  ONE CONFIG FILE, TWO SERVICES                               │
│                                                              │
│  /etc/dnsmasq.conf                                           │
│  ├── DNS directives                                          │
│  │   ├── interface=eth1                                      │
│  │   └── server=8.8.8.8                                      │
│  └── DHCP directives                                         │
│      ├── dhcp-range=eth1,192.168.1.100,192.168.1.200,12h      │
│      ├── dhcp-option=option:router,192.168.1.254              │
│      └── dhcp-host=00:11:22:33:44:55,192.168.1.50,printer     │
│                                                              │
│  dnsmasq --test validates the entire file                    │
│  systemctl restart dnsmasq applies the changes                │
└──────────────────────────────────────────────────────────────┘

Default vs Overridden Options

┌──────────────────────────────────────────────────────────────┐
│  dnsmasq SENDS ITS OWN ADDRESS BY DEFAULT                    │
│                                                              │
│  Without dhcp-option overrides:                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Gateway  = dnsmasq's IP (e.g., 192.168.1.10)           │  │
│  │ DNS      = dnsmasq's IP (e.g., 192.168.1.10)           │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  With overrides:                                             │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ dhcp-option=option:router,192.168.1.254                │  │
│  │ dhcp-option=option:dns-server,192.168.1.1              │  │
│  │                                                        │  │
│  │ Gateway  = 192.168.1.254 (the router)                  │  │
│  │ DNS      = 192.168.1.1 (the DNS server)                │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  Override when the router and DNS are separate devices.      │
└──────────────────────────────────────────────────────────────┘

Lease File

┌──────────────────────────────────────────────────────────────┐
│  /var/lib/misc/dnsmasq.leases                                │
│                                                              │
│  Format: <expiry> <mac> <ip> <hostname> <client-id>          │
│                                                              │
│  1705310000 00:11:22:33:44:55 192.168.1.101 pc1 *            │
│  │          │                 │             │   │            │
│  │          │                 │             │   └── no client ID
│  │          │                 │             └── hostname      │
│  │          │                 └── assigned IP                │
│  │          └── MAC address                                  │
│  └── expiry (epoch seconds)                                 │
│                                                              │
│  The file is updated as clients request and renew leases.    │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
DHCP enablement	`dhcp-range=<start>,<end>,<lease>`
Interface restriction	`dhcp-range=<if>,<start>,<end>,<lease>`
Static reservation	`dhcp-host=<mac>,<ip>,<name>,<lease>`
Infinite lease	`...,infinite` in `dhcp-host`
Gateway override	`dhcp-option=option:router,<ip>`
DNS override	`dhcp-option=option:dns-server,<ip>`
Domain name	`dhcp-option=option:domain-name,<name>`
Lease file	`/var/lib/misc/dnsmasq.leases`
Validation	`dnsmasq --test`
Default gateway	dnsmasq’s own address (override required)
Default DNS	dnsmasq’s own address (override required)

Key takeaways:

dnsmasq’s DHCP is enabled by dhcp-range. Without it, the DHCP service is inactive. The range defines the pool, and the interface specification restricts it to one NIC on multi-homed hosts .
The default gateway and DNS are dnsmasq’s own address. If the network uses a separate router or separate DNS servers, dhcp-option directives are required to override these defaults .
dhcp-host reserves addresses for specific clients. The MAC address identifies the client, and the IP address can be outside the dynamic range but must be on the same subnet. The infinite lease time is appropriate for infrastructure devices .
The lease file records every assignment. /var/lib/misc/dnsmasq.leases contains the expiry time, MAC, IP, hostname, and client ID for each active lease .
dnsmasq --test validates the configuration. It catches syntax errors before the service is restarted. A configuration error prevents the daemon from starting.
DHCP and DNS share the same configuration file. Unlike ISC DHCP, dnsmasq combines both services in /etc/dnsmasq.conf. The same --test command validates both .

Remember: dnsmasq’s DHCP is the small-network counterpart to ISC DHCP. It uses one configuration file for both DNS and DHCP, it defaults to sending its own address as the gateway and DNS server, and it records leases in a plain text file. Enable it with dhcp-range, override the defaults with dhcp-option when the router and DNS are separate devices, reserve addresses with dhcp-host, and validate with --test. The lease file shows what has been assigned, and the logs show the DORA exchanges. For a small network where a single daemon can serve both DNS and DHCP, dnsmasq is the simpler choice.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!