DHCP relay

A client's Discover is a broadcast, which stops at the router. A relay (ip helper-address on IOS, set on the client-facing interface) sends it on by unicast to the server, with its own address on the client's network as the giaddr. The server picks the pool whose subnet holds the giaddr and replies to the relay, which hands the answer to the client; the server needs a route back. With option 82 the relay also says where the request came from: a circuit ID for the port, a remote ID for itself.

How a DHCP relay works, step by step

A DHCP client starts with no address and broadcasts its Discover to 255.255.255.255 (RFC 2131). Routers do not forward broadcasts, so a server hears only clients on its own segment. A relay agent (RFC 1542) carries the exchange across the router, so one server can serve many networks. In the DHCP relay lab one server dhcpServer 10.0.3.10 serves two floors: floor1Lan 10.0.1.0/24 and floor2Lan 10.0.2.0/24, with coreRouter relaying, its address 10.0.1.2 and 10.0.2.2 on each floor.

1. The client broadcasts a Discover from 0.0.0.0 port 68 to 255.255.255.255 port 67. The router receives it because it is on the link, but does not forward the broadcast.
2. The relay rewrites and unicasts it to the server on port 67, setting giaddr (the gateway IP address field) to its own address on the client's network, here 10.0.2.2, and counting hops.
3. The server picks the pool by giaddr. 10.0.2.2 falls in 10.0.2.0/24, so it leases from floor 2's pool and sends floor 2's gateway. Without a relay it would use the subnet of the receiving card.
4. The reply goes back to the giaddr, not the client, which has no address yet. The server needs a route back to 10.0.2.2 through coreRouter.
5. The relay delivers it to the client, and the Request and ACK follow the same path. Later renewals need no relay: the client now has an address and the server's, so it unicasts directly.

With option 82 the relay also records where the request came from, covered below.

What it looks like on a Linux machine

coreRouter runs ISC dhcrelay, listening for clients on each floor's card (-id) and talking upstream on the server's (-iu):

$ dhcrelay -4 -a -id eth0 -id eth1 -iu eth2 10.0.3.10

A capture on the relay shows the four legs. tcpdump labels DHCP BOOTP/DHCP, with Request meaning toward a server and Reply from one:

$ tcpdump -nn -i any -v udp port 67 or port 68
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ...
10.0.3.2.67 > 10.0.3.10.67: BOOTP/DHCP, Request ... hops 1
	  Gateway-IP 10.0.2.2
10.0.3.10.67 > 10.0.2.2.67: BOOTP/DHCP, Reply ...
10.0.2.2.67 > 10.0.2.56.68: BOOTP/DHCP, Reply ...

The client's lease comes from a server on neither of its networks:

$ udhcpc -i eth0 -n -q
udhcpc: lease of 10.0.2.56 obtained from 10.0.3.10, lease time 300

The server reaches the relay's floor-2 address through the router, which is why its offers arrive:

$ ip route get 10.0.2.2
10.0.2.2 via 10.0.3.2 dev eth0 src 10.0.3.10

What goes wrong, and how you see it

One network gets nothing, another is fine. If the relay is started without a client-facing card for a floor, that floor's broadcasts reach the router and stop there. A capture shows 0.0.0.0.68 > 255.255.255.255.67 arriving and nothing going on to 10.0.3.10.67. The fix is a -id for each client network (one helper address per client-facing interface).

Requests arrive, offers never come back. The server logs an offer, the client never sees it. The reply goes to the giaddr, so the server needs a route to every relayed network; ip route get 10.0.2.2 answering Network unreachable is the cause. Add the route back.

No address range available. The server's log reads no address range available for DHCP request via 10.0.2.2: it got the request but has no pool containing the giaddr. Add the missing pool.

Double option 82. A snooping switch and the router both add relay agent information; a server set to drop mismatches discards the request. The DHCP relay lab walks all of these.

Questions people ask

What is giaddr? The gateway IP address field in the DHCP header. The relay writes its own address on the client's network into it; the server reads it to pick the right pool and to know where to send the reply.

What is a DHCP helper address? The Cisco name for the same thing: ip helper-address 10.0.3.10 on an interface turns that interface into a relay toward that server. On Linux it is dhcrelay.

What is option 82? Relay agent information: a circuit ID naming the port the request came in on and a remote ID naming the relay, so the server can assign and log by location. See DHCP.

See it on real machines