LFCE 43 🐧 isc-dhcp-server — Reservations and Options - KandZ

⏱️ Estimated read: 12 min | |

A DHCP server that only assigns addresses from a dynamic pool is useful for laptops and phones, but it is insufficient for the devices that must always be reachable at the same address. Printers, servers, switches, and access points need stable addressing, and the DHCP server must know which MAC address belongs to which reserved address. The host declaration in dhcpd.conf provides this reservation mechanism. Separately, the option statements control what configuration the client receives alongside its address—the gateway, the DNS servers, the domain name, and the lease duration. The previous chapter configured a basic pool; this chapter adds the reservations and option scopes that make the server suitable for a real network.

Key point: A host declaration with hardware ethernet and fixed-address reserves a specific address for a specific MAC address. The reserved address should not fall inside the dynamic range, because the server pre-allocates the dynamic pool at startup and does not know about fixed addresses elsewhere in the configuration . Options can be set at three scopes—global, subnet, and host—and the most specific scope wins. The authoritative directive and the default-lease-time / max-lease-time statements belong at the global level unless a subnet needs different values.

Why reservations require explicit declarations

The pool-overlap problem.

The dynamic range defines the addresses that the server can assign to any client. If a reserved address is inside that range, the server may assign it to a different client before the reserved device requests it. The ISC documentation explicitly warns that IPv4 dynamic pools should not overlap with static lease assignments, because the pool entries are pre-allocated at startup and the server has no knowledge of the fixed addresses during that process . The reserved address must be outside the range, or the range must be split around it.

The option-scope problem.

An option set at the global level applies to every client unless a more specific scope overrides it. A subnet-level option applies to every client on that subnet. A host-level option applies only to the client matched by the host declaration. The gateway and DNS servers are usually set at the subnet level, because different subnets have different gateways. The domain name and lease times are often set globally. A host-level option is used when a specific device needs a different DNS server or a different boot file than the rest of the subnet .

The known-client problem.

A client that matches a host declaration is considered “known” by the server. If the host declaration has a fixed-address, the client must take that address; if it requests a different address, the server responds with a DHCPNAK . This behavior is correct for reservations, but it means that a host declaration without a fixed-address makes the client known while still allowing dynamic assignment. The host declaration is the mechanism for both reservations and per-host options.

a. Configuring host reservations

A host declaration matches a client by its MAC address (or client identifier) and assigns a fixed address. The declaration can be placed inside a subnet block or at the global level. Placing it inside the subnet makes the association with the network explicit.

# /etc/dhcp/dhcpd.conf
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;        # Dynamic pool

    option routers 192.168.1.254;
    option domain-name-servers 192.168.1.1, 192.168.1.2;

    # Reservation for a printer
    host printer {
        hardware ethernet 00:11:22:33:44:55;
        fixed-address 192.168.1.50;           # Outside the dynamic range
    }

    # Reservation for a server
    host fileserver {
        hardware ethernet aa:bb:cc:dd:ee:ff;
        fixed-address 192.168.1.10;
        option host-name "fileserver.example.com";
    }
}

The hardware ethernet value is the client’s MAC address. The fixed-address is the address the client will always receive. The option host-name inside the host declaration tells the client what hostname to use, which is useful for devices that do not have a configured hostname. The reserved addresses (192.168.1.50 and 192.168.1.10) are outside the dynamic range (100–200), which prevents the pool from assigning them to another client .

If a client needs to boot on multiple subnets with different fixed addresses, the fixed-address statement can list multiple addresses, and the server assigns the one that belongs to the subnet the client is connected to . For most networks, a single address per host is sufficient.

b. Setting options at global, subnet, and host scope

The option statements can appear at three levels. The global level is at the top of the file, outside any subnet or host block. The subnet level is inside a subnet block. The host level is inside a host block.

# Global options: apply to all clients unless overridden
option domain-name "example.com";
option domain-name-servers 192.168.1.1, 192.168.1.2;
default-lease-time 600;
max-lease-time 7200;
authoritative;

# Subnet-level options: override global for this subnet
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.254;              # Gateway for this subnet
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.168.1.255;
    option domain-name-servers 192.168.1.1;    # Overrides global DNS for this subnet

    # Host-level option: only for the printer
    host printer {
        hardware ethernet 00:11:22:33:44:55;
        fixed-address 192.168.1.50;
        option domain-name-servers 192.168.1.1; # Printer-specific DNS if needed
    }
}

The option routers and option subnet-mask are typically set at the subnet level, because they differ between subnets. The option domain-name and option domain-name-servers can be global if all subnets use the same DNS servers, or subnet-specific if they do not. The default-lease-time and max-lease-time are global unless a specific subnet or host needs different values .

The option host-name is a special case. When set in a host declaration, it tells the client what hostname to configure. This is useful for devices that report an empty or generic hostname in their DHCP request. The server can override the client’s requested hostname with this option.

c. Validation and applying the configuration

The dhcpd -t command validates the configuration syntax before the service is restarted. It reports the file and line number of any error, which is essential for catching a missing semicolon or a misplaced brace.

# Validate the configuration
sudo dhcpd -t -cf /etc/dhcp/dhcpd.conf
# Output: no errors

# Restart the service to apply the changes
sudo systemctl restart isc-dhcp-server

# Check the service status
sudo systemctl status isc-dhcp-server

After the service is running, the reservation is verified by checking the lease file after the client requests an address. The lease file records the MAC address, the assigned IP, and the lease duration. A reserved address appears with a binding state active and the client’s hardware address.

# Check the lease file for the reservation
sudo grep -A5 "192.168.1.50" /var/lib/dhcp/dhcpd.leases
# Output includes: hardware ethernet 00:11:22:33:44:55;
#                  binding state active;

If the client does not receive the reserved address, the most common causes are a MAC address mismatch, a reserved address inside the dynamic range, or a syntax error that prevented the service from reloading the configuration.

Complete Example Session

# ============================================
# PART 1: THE GLOBAL OPTIONS
# ============================================
sudo tee /etc/dhcp/dhcpd.conf > /dev/null <<'EOF'
authoritative;
default-lease-time 600;
max-lease-time 7200;
option domain-name "example.com";
option domain-name-servers 192.168.1.1, 192.168.1.2;
EOF

# ============================================
# PART 2: THE SUBNET AND DYNAMIC RANGE
# ============================================
sudo tee -a /etc/dhcp/dhcpd.conf > /dev/null <<'EOF'

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;
    option routers 192.168.1.254;
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.168.1.255;
EOF

# ============================================
# PART 3: THE PRINTER RESERVATION
# ============================================
sudo tee -a /etc/dhcp/dhcpd.conf > /dev/null <<'EOF'

    host printer {
        hardware ethernet 00:11:22:33:44:55;
        fixed-address 192.168.1.50;
        option host-name "printer";
    }
EOF

# ============================================
# PART 4: THE SERVER RESERVATION
# ============================================
sudo tee -a /etc/dhcp/dhcpd.conf > /dev/null <<'EOF'

    host fileserver {
        hardware ethernet aa:bb:cc:dd:ee:ff;
        fixed-address 192.168.1.10;
        option host-name "fileserver.example.com";
        option domain-name-servers 192.168.1.1;    # Override for this host
    }
}
EOF

# ============================================
# PART 5: VALIDATE THE CONFIGURATION
# ============================================
sudo dhcpd -t -cf /etc/dhcp/dhcpd.conf
# Output: no errors

# ============================================
# PART 6: RESTART THE SERVICE
# ============================================
sudo systemctl restart isc-dhcp-server
sudo systemctl status isc-dhcp-server

# ============================================
# PART 7: VERIFY THE RESERVATION IN THE LEASE FILE
# ============================================
# After the printer requests an address:
sudo grep -B2 -A8 "192.168.1.50" /var/lib/dhcp/dhcpd.leases
# Output shows the hardware ethernet and binding state

# ============================================
# PART 8: CHECK THE LOGS FOR THE RESERVATION
# ============================================
sudo journalctl -u isc-dhcp-server -n 20
# Or: sudo tail -f /var/log/syslog | grep dhcpd
# Output shows DHCPACK for 192.168.1.50 to the printer's MAC

# ============================================
# PART 9: TEST A DYNAMIC CLIENT
# ============================================
# A client that does not match a host declaration receives
# an address from the dynamic range (192.168.1.100-200)

# ============================================
# PART 10: VERIFY THE OPTIONS ON THE CLIENT
# ============================================
# On the client:
# ip addr show eth0          → assigned address
# ip route show              → default via 192.168.1.254
# cat /etc/resolv.conf       → nameserver 192.168.1.1

The ten parts demonstrate the complete reservation and option configuration: global options, subnet and range, host reservations with fixed addresses, validation, restart, lease verification, log inspection, and client-side verification. The critical distinction is Part 4: the fileserver reservation overrides the global DNS option with a host-specific one, demonstrating the scope hierarchy.

Quick Reference

Host Reservation Syntax

Statement	Purpose
`host <name> { ... }`	Match a specific client
`hardware ethernet <mac>;`	Client’s MAC address
`fixed-address <ip>;`	Reserved IP address
`option host-name "<name>";`	Hostname to assign

Option Scopes

Scope	Location	Applies To
Global	Top of file	All clients
Subnet	Inside `subnet` block	Clients on that subnet
Host	Inside `host` block	The matched client

Common Options

Option	Purpose
`option routers <ip>;`	Default gateway
`option domain-name-servers <ip>;`	DNS servers
`option subnet-mask <mask>;`	Subnet mask
`option broadcast-address <ip>;`	Broadcast address
`option domain-name "<name>";`	DNS domain suffix
`option host-name "<name>";`	Client hostname

Commands

Command	Purpose
`dhcpd -t -cf /etc/dhcp/dhcpd.conf`	Validate configuration
`systemctl restart isc-dhcp-server`	Apply changes
`grep -A5 "<ip>" /var/lib/dhcp/dhcpd.leases`	Check reservation lease
`journalctl -u isc-dhcp-server`	View logs

Best Practices

✅ Do This:

# Place reserved addresses outside the dynamic range
range 192.168.1.100 192.168.1.200;
host printer { fixed-address 192.168.1.50; }                  # ✅

# Set gateway at the subnet level
option routers 192.168.1.254;                                 # ✅

# Set DNS at the global level if all subnets share it
option domain-name-servers 192.168.1.1;                      # ✅

# Override options at the host level when needed
host fileserver { option domain-name-servers 192.168.1.1; }  # ✅

# Validate before restarting
dhcpd -t -cf /etc/dhcp/dhcpd.conf                            # ✅

❌ Don’t Do This:

# Put a reserved address inside the dynamic range
range 192.168.1.50 192.168.1.200;
host printer { fixed-address 192.168.1.50; }    # Conflict      # ❌

# Omit the subnet declaration for a reservation
# The host cannot be matched without a subnet                # ❌

# Use a MAC address that does not match the device
hardware ethernet 00:11:22:33:44:55;    # Verify the device # ❌

# Set the gateway at the global level for multiple subnets
option routers 192.168.1.254;    # Wrong for other subnets   # ❌

# Restart without validation
systemctl restart isc-dhcp-server    # Syntax error causes outage # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Reservation not applied	MAC address mismatch	Verify the device’s MAC with `ip link`
Address conflict	Reserved IP inside dynamic range	Move reservation outside `range`
Client receives dynamic address	`host` declaration missing or malformed	Check the `hardware ethernet` value
Wrong gateway	`option routers` set at global scope	Set it inside the `subnet` block
DNS option not overridden	Host-level option syntax error	Verify the `option` statement inside `host`
Service fails to start	Missing semicolon or brace	`dhcpd -t` reports the line

Real-World Examples

1. Printer reservation

host printer { hardware ethernet 00:11:22:33:44:55; fixed-address 192.168.1.50; }

2. Server reservation with hostname

host fileserver { hardware ethernet aa:bb:cc:dd:ee:ff; fixed-address 192.168.1.10; option host-name "fileserver"; }

3. Global DNS option

option domain-name-servers 192.168.1.1, 192.168.1.2;

4. Subnet-level gateway

subnet 192.168.1.0 netmask 255.255.255.0 { option routers 192.168.1.254; }

5. Host-level DNS override

host fileserver { option domain-name-servers 192.168.1.1; }

6. Global lease times

default-lease-time 600; max-lease-time 7200;

7. Validate configuration

dhcpd -t -cf /etc/dhcp/dhcpd.conf

8. Check reservation lease

grep -A5 "192.168.1.50" /var/lib/dhcp/dhcpd.leases

9. View DHCP logs

journalctl -u isc-dhcp-server -n 20

10. Restart service

systemctl restart isc-dhcp-server

Visual

Option Scope Hierarchy

┌──────────────────────────────────────────────────────────────┐
│  MOST SPECIFIC SCOPE WINS                                    │
│                                                              │
│  Global                                                      │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ option domain-name-servers 192.168.1.1, 192.168.1.2    │  │
│  │ default-lease-time 600;                                │  │
│  │ authoritative;                                         │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│                           ▼                                  │
│  Subnet 192.168.1.0/24                                       │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ range 192.168.1.100 192.168.1.200;                     │  │
│  │ option routers 192.168.1.254;    ← subnet-specific     │  │
│  │ option domain-name-servers 192.168.1.1; ← overrides    │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│                           ▼                                  │
│  Host fileserver                                             │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ hardware ethernet aa:bb:cc:dd:ee:ff;                   │  │
│  │ fixed-address 192.168.1.10;                            │  │
│  │ option domain-name-servers 192.168.1.1; ← host-specific│  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  The client receives the most specific value for each option.│
└──────────────────────────────────────────────────────────────┘

Reservation vs Dynamic Assignment

┌──────────────────────────────────────────────────────────────┐
│  RESERVED ADDRESSES ARE OUTSIDE THE DYNAMIC RANGE            │
│                                                              │
│  192.168.1.0/24                                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ .1-.99        │ .100-.200        │ .201-.254           │  │
│  │ Static/       │ Dynamic range    │ Static/             │  │
│  │ Reserved      │ (DHCP pool)      │ Reserved            │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  printer: 192.168.1.50    → outside pool                    │
│  fileserver: 192.168.1.10 → outside pool                    │
│  dynamic client: 192.168.1.150 → from pool                  │
│                                                              │
│  If a reserved address is inside the pool, the server may    │
│  assign it to a dynamic client before the reserved device    │
│  requests it.                                                │
└──────────────────────────────────────────────────────────────┘

Host Declaration Matching

┌──────────────────────────────────────────────────────────────┐
│  THE SERVER MATCHES THE CLIENT BY MAC ADDRESS                │
│                                                              │
│  Client sends DHCPDISCOVER                                   │
│  ├── MAC address: 00:11:22:33:44:55                          │
│  └── Requested options                                       │
│                                                              │
│  Server searches host declarations                           │
│  ├── host printer { hardware ethernet 00:11:22:33:44:55; }   │
│  │     → MATCH                                               │
│  └── host fileserver { hardware ethernet aa:bb:cc:dd:ee:ff; }│
│        → NO MATCH                                            │
│                                                              │
│  Server responds with:                                       │
│  ├── fixed-address 192.168.1.50                              │
│  ├── option host-name "printer"                              │
│  └── subnet-level options (gateway, DNS)                     │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Reservation mechanism	`host` declaration
Match field	`hardware ethernet <mac>`
Address assignment	`fixed-address <ip>`
Reserved address placement	Outside the dynamic `range`
Option scopes	Global, subnet, host
Gateway option	Usually subnet-level
DNS option	Global or subnet-level
Host-level override	For device-specific configuration
Validation	`dhcpd -t -cf /etc/dhcp/dhcpd.conf`
Lease verification	`grep -A5 "<ip>" /var/lib/dhcp/dhcpd.leases`

Key takeaways:

A host declaration reserves an address for a specific MAC. The hardware ethernet field matches the client, and fixed-address assigns the reserved IP. The client must take that address; a request for a different address receives a DHCPNAK .
Reserved addresses must be outside the dynamic range. The server pre-allocates the dynamic pool at startup and does not know about fixed addresses elsewhere in the configuration. An overlap can cause the reserved address to be assigned to a different client .
Options can be set at three scopes. Global options apply to all clients, subnet options apply to clients on that subnet, and host options apply to the matched client. The most specific scope wins .
The gateway is a subnet-level option. Different subnets have different gateways. Setting option routers at the global level is incorrect for networks with multiple subnets.
The option host-name sets the client’s hostname. This is useful for devices that report an empty or generic hostname. The server overrides the client’s request with the configured value .
Validate before restarting. dhcpd -t catches syntax errors before the service is restarted. A configuration error prevents the daemon from starting, and no clients receive addresses.

Remember: Reservations and options are the configuration layer that turns a basic DHCP pool into a managed network service. The host declaration binds a MAC address to an IP address, and the reserved address must be outside the dynamic range. The option statements populate the client’s gateway, DNS, and domain configuration, and their scope determines which clients receive which values. Validate with dhcpd -t, restart the service, and verify the reservation in the lease file. The client receives the address and the options together, and the server’s configuration determines both.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!