Prerequisites

• VyOS configured as per Setting Up VyOS as a Proxmox VM — specifically, eth1 assigned a static IP on the lab subnet

DHCP Pool

Running DHCP on the router keeps address assignment in the same place as routing. VyOS includes a DHCP server out of the box.

Official reference: VyOS DHCP Server

Enter configuration mode and define the subnet. Replace 10.x.x.x placeholders with your actual lab subnet values:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

configure

set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 default-router '10.x.x.1'
set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 name-server '10.x.x.1'
set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 lease '86400'
set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 range 0 start '10.x.x.100'
set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 range 0 stop '10.x.x.200'

commit
save

• default-router — the gateway handed to clients; the VyOS lab interface IP
• name-server — the DNS server handed to clients; points to VyOS, which handles forwarding as configured below
• lease — lease duration in seconds; 86400 is 24 hours
• range 0 — the dynamic pool; addresses below .100 are left free for static mappings

Static Mappings

Servers that other services depend on — the NAS, Kubernetes workers, monitoring hosts — should always receive the same IP. Static mappings bind a MAC address to a fixed IP, served via DHCP:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

configure

set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 static-mapping nas mac '00:11:22:33:44:55'
set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 static-mapping nas ip-address '10.x.x.10'

set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 static-mapping k8s-worker-01 mac '00:11:22:33:44:66'
set service dhcp-server shared-network-name lab subnet 10.x.x.0/24 static-mapping k8s-worker-01 ip-address '10.x.x.11'

commit
save

The name (nas, k8s-worker-01) is a local label used in lease logs. It appears in show dhcp server leases output, making it easier to track which host has which address.

DNS Forwarding

VyOS includes a DNS forwarder powered by PowerDNS Recursor. Configuring it on the lab interface means every DHCP client that receives 10.x.x.1 as its DNS server is automatically covered — no separate resolver needed.

Official reference: VyOS DNS Forwarding

1
2
3
4
5
6
7
8
9

configure

set service dns forwarding listen-address '10.x.x.1'
set service dns forwarding allow-from '10.x.x.0/24'
set service dns forwarding name-server '1.1.1.1'
set service dns forwarding name-server '8.8.8.8'

commit
save

• listen-address — the lab interface IP VyOS accepts DNS queries on
• allow-from — restricts queries to the lab subnet; anything outside this range is dropped
• name-server — upstream resolvers that unrecognised queries are forwarded to

Verifying

Check active DHCP leases:

1

show dhcp server leases

Test DNS forwarding from a lab host:

1

dig @10.x.x.1 google.com

A newly connected lab host should appear in the lease table within seconds. google.com should return a public A record via the upstream resolvers.

What’s Next

• Authoritative DNS with BIND — running a primary/secondary BIND9 pair on LXC for internal name resolution
• VRRP redundancy — adding a second VyOS instance for failover
• BGP peering with Kubernetes — dynamically routing Kubernetes service IPs through VyOS