How to Set Up Static IP Addresses in OPNsense

OPNsense icon
Image: opnsense.org

The best way to assign static IP addresses to devices on your LAN is to use static DHCP mappings so that specific devices always get the same IP from OPNsense’s DHCP server.

To ensure a specific device always receives the same IP address from the DHCP server:

  1. Go to Services > DHCPv4 > [LAN] (or the relevant interface).
  2. Scroll down to the DHCP Static Mappings for this Interface section.
  3. Click the + button to add a new static mapping.
  4. Enter the device’s MAC address and the desired IP address.
  5. Optionally, add a hostname and description.
  6. Click Save and then Apply Changes.

If you need to set static IPs for interfaces used in clustering or high-availability setups (like Proxmox VE, Kubernetes or Docker Swarm), you should always configure those interfaces with static IPs directly in the interface settings (on the individual device), not via DHCP, to ensure reliability and avoid network disruptions.

For example, the subnet for my LAN is 172.16.30.0/28. My DHCP server hands out IP addresses between 172.16.30.10 and 172.16.30.253. My IoT devices and some Proxmox virtual hosts have static IP addresses that I set using OPNsense and the rest the devices get an IP via DHCP, also set by OPNsense.

My Proxmox VE host nodes each have a an IP address in that same subnet so that they can be accessed by other devices on the LAN or the public internet, but they are also connected to a dedicated backhual network using a different physical interface.

For this, I created a new subnet 10.42.1.0/28 with only 14 usable hosts. The three Proxmox hosts are the only devices in that subnet connected to a 2.5Gbe switch and are not recorded in OPNsense:

  • Moe 10.42.1.1/28
  • Larry 10.42.1.2/28
  • Curly 10.42.1.3/28

No gateway or special routing is required as the only traffic on that subnet goes between the nodes and not to the public internet. Any required internet access - such as off-site backups or downloading media - happens through the general LAN connection.