Blog
Multi-Subnet DHCP with Relays: Turning Your Address Plan into a Table That Won't Blow Up
Once you're past a couple of subnets, two things keep me up at night: every router running its own DHCP pool and fighting its neighbors, and printer IPs getting wiped out by a lease. We centralized DHCP on a Windows/Kea pair (or the firewall), and the access layer only relays. This post is about the planning method — not vendor button-clicking.
The planning table (fill it in before you click anything)
| VLAN | Subnet | Gateway | DHCP pool | Exclusions/static | DNS | Lease |
|---|---|---|---|---|---|---|
| 10 Endpoints | 10.10.10.0/24 | .1 | .50-.200 | .2-.49 infrastructure | Internal DNS | 8h |
| 20 Servers | 10.10.20.0/24 | .1 | None or tiny | Almost all static | Internal DNS | - |
| 30 Guest | 10.10.30.0/24 | .1 | .20-.250 | .2-.19 | Public is fine | 2h |
| 40 Low-trust | 10.10.40.0/24 | .1 | .100-.200 | Cameras/NVR static | Policy-dependent | 24h |
Static where you can on the server subnet — don't dig yourself the "AD's IP changed" trap.
Relays
Configure ip helper-address (or the vendor equivalent) on the L3 interface / SVI, pointing at the DHCP server. Things to watch:
- The relay targets the server's unicast IP, not a broadcast;
- Point multiple helpers at multiple DHCP servers for redundancy;
- Firewall rules: client ↔ relay stays local, but the server has to accept relayed UDP 67/68 traffic coming from the gateway.
Exclusions and reservations
- Gateways, switch management addresses, wireless controllers: exclude;
- Printers and time clocks: reserve, bound by MAC;
- Don't fake static with a one-year lease — renewal and migration hurt worse.
Picking lease lengths
- Office endpoints: 8–12 hours, balancing address recovery against laptop sleep;
- Guests: 1–4 hours, so the pool can't fill up;
- Meeting-room tablets: a bit longer, or reserve them.
Monitor pool utilization too: when a pool fills up, the symptom is "internet works intermittently," which reads exactly like a Wi-Fi problem.
High availability
- DHCP failover (Windows) or primary/backup lease sync;
- Keep both servers' clocks in sync;
- Drill it: stop the primary and verify new clients still get addresses.
AD and PXE
Imaging via PXE needs the right options — boot server and filename. With relays, the DHCP server hands those options out, so don't write the wrong boot config into the wrong scope.
One incident
Someone "casually" enabled DHCP on a floor-level mini router, on the same subnet as our central pool. Symptoms: some machines ended up with a rogue router at .254 as their gateway, and internet flaked in and out. Fixes: hunt down and kill the rogue DHCP, roll out port security / DAI gradually depending on the environment, and make unregistered DHCP against policy.
Wrap-up
DHCP is the least glamorous network service and the easiest one to take down the whole building. One planning table, plus relays, exclusions/reservations, and pool-utilization monitoring, beats fumbling with scopes in a GUI at the last minute. When a network engineer writes this on their résumé, "centralized multi-VLAN DHCP with relays and reservation policy" reads like real project experience — "knows how to configure DHCP" doesn't.