pfSense WAN Not Getting a DHCP IP Address: Diagnostic Guide

The problem and the useful takeaway

A pfSense WAN interface that shows "Down" or "No IP" means the firewall has no public address and cannot route traffic to the internet. The most common reason is that pfSense is not sending DHCP discovery requests, is sending them but getting no answer, or is discarding the reply. This guide helps you identify which of those is happening and apply the matching fix.

WAN is the interface facing your ISP. DHCP is the protocol that automatically assigns an IP address, subnet mask, gateway, and DNS servers. A lease is the temporary assignment of that address, which must be renewed before it expires.

Recognizable condition

You are likely dealing with this issue if:

• Diagnostics > Status > Interfaces shows WAN as Down or with no IPv4 address.
• Systems behind pfSense cannot reach external websites or IP addresses.
• The WAN configuration page shows IPv4 Configuration Type set to something other than DHCP.
• Status > System Logs > DHCP client contains no recent lease entries.

Cause and diagnostic table

Observation	Likely cause	Where to verify
WAN type is Static or disabled	DHCP client is not active on WAN	Interfaces > WAN
No DHCP discover or request messages in log	Client not running, or interface not brought up	Status > System Logs > DHCP client
Discover sent, no offer received	Upstream modem/ONT not responding, or cable issue	Diagnostics > Packet Capture
Offer received but no lease assigned	pfSense client not accepting offer, or conflict with existing lease	Status > System Logs > DHCP client
Traffic blocked on WAN	Firewall rule dropping DHCP packets	Firewall > Rules > WAN

Ordered checks

1. Confirm WAN is set to DHCP. Go to Interfaces > WAN. Under IPv4 Configuration Type, select DHCP if it is set to Static IPv4 or None. Save and Apply Changes. This is the most common misconfiguration.
2. Check the DHCP client log. Navigate to Status > System Logs > DHCP client. Look for lines mentioning DISCOVER, REQUEST, OFFER, or ACK. If the log is empty, the client may not have started after the last save.
3. Inspect WAN firewall rules. Go to Firewall > Rules > WAN. Ensure there is a rule allowing UDP traffic on source port 68 to destination port 67, and the return traffic on port 67 to port 68. By default, pfSense often blocks inbound WAN traffic, which can prevent the DHCP offer from reaching the client.
4. Capture packets on WAN. Use Diagnostics > Packet Capture. Select the WAN interface, protocol UDP, and ports 67 and 68. Start the capture, then save and apply the WAN interface or wait for a lease renewal. Look for discover/request packets leaving and offer/ack packets arriving.
5. Test the upstream device directly. Connect a laptop directly to the modem or ONT where pfSense WAN was connected, set it to obtain an IP automatically, and check whether it receives an address. This isolates whether the problem is pfSense or the ISP equipment.

Fixes tied to findings

DHCP client disabled or set to static

Set Interfaces > WAN > IPv4 Configuration Type to DHCP. Save, then click Apply Changes. If the WAN was previously static, remove any static IP, subnet mask, and gateway fields so they do not conflict with the DHCP assignment.

Firewall rules block DHCP

Add a WAN firewall rule:

• Action: Pass
• Interface: WAN
• Protocol: UDP
• Source: any
• Destination: WAN address
• Destination port range: 67
• Source port range: 68

Also allow the return direction if your rule set is stateful but restrictive. After saving, Apply Changes and recheck the DHCP log.

Upstream device not responding

Power cycle the modem or ONT, then wait for it to fully synchronize before reapplying the WAN interface in pfSense. Some ISP equipment binds to the MAC address of the first device it sees. If you recently replaced a router, use the MAC spoofing option in Interfaces > WAN to clone the previous device's MAC address, then renew the lease.

Offer received but no lease

If the log shows OFFER but no bound address, release any existing lease first. In the pfSense shell (SSH or console, requires admin privileges), you can restart the DHCP client process. Be aware this will briefly interrupt WAN connectivity. After restarting, watch the DHCP client log for a new ACK.

# Example only: run at the pfSense shell, requires root/admin access
# Replace wan with your actual WAN interface identifier if different
service isc-dhclient restart wan

Do not run shell commands unless you are comfortable losing remote access temporarily. If you are managing pfSense over the WAN interface, a misapplied change can disconnect your session.

Escalation criteria

Contact your ISP or escalate internally when:

• A directly connected device also fails to obtain an IP from the modem or ONT.
• The modem shows an offline or authentication error on its status page.
• pfSense receives DHCP offers but never completes a lease across multiple reboots and cable changes.
• You suspect the upstream DHCP server is not serving your account or line.

Before opening a support ticket, gather the WAN MAC address, the modem model, and a packet capture showing discover packets with no response.

Limitations and verification

This guide covers DHCP-based WAN only. It does not apply to PPPoE, static IP, or cellular WAN interfaces. It assumes a current supported pfSense release with the default web GUI layout.

Verify the fix by checking Diagnostics > Status > Interfaces. The WAN should list an IPv4 address, subnet mask, and gateway. Then ping a public IP such as 1.1.1.1 from Diagnostics > Ping. If the ping succeeds but DNS fails, check System > General Setup for DNS servers assigned by DHCP.

Rollback

Because changing WAN type or firewall rules alters live network state, back up the configuration first: Diagnostics > Backup & Restore > Back up. If a change breaks connectivity, restore the backup or revert Interfaces > WAN to its previous setting and Apply Changes. Have console or local access available before making changes, since remote management may be lost while WAN is down.