DHCP hands out addresses; DNS turns names into addresses. On OPNsense both run on the firewall itself, which means one box decides how every device finds everything. Set them up once, properly — static addresses for the devices that matter, local names that actually resolve — and a whole class of home-network gremlins disappears.
Out of the box, OPNsense already runs a DHCP server on LAN and the Unbound DNS resolver, so a fresh install 'just works'. The setup worth doing is the tidy-up: a sensible address pool, static mappings for infrastructure, and local DNS names so nas.home works instead of a memorised IP. This guide also covers the Kea-versus-ISC question in current versions and how to point DNS upstream without breaking name resolution for your own network.
Decide a simple scheme and write it down: the firewall at .1, infrastructure (NAS, printer, recorder, access points) in the low numbers, the automatic DHCP pool in a middle band, and room to grow. Static mappings should live outside or clearly inside the pool consistently — OPNsense handles mappings inside the pool correctly, but a written plan prevents the classic mess where a printer and a phone fight over one address. Ten minutes of planning saves every future troubleshooting session.
A static mapping ties a device's MAC address to a chosen IP inside OPNsense's DHCP settings (Services → Kea DHCP in recent versions, ISC DHCPv4 in older ones). The device still asks for an address automatically, and always receives the same one. This beats typing a static IP into each device, because the firewall stays the single source of truth and the device keeps working if you ever renumber the network. Find the MAC in the DHCP leases page after the device first connects, then convert that lease into a mapping with the address you planned.
Unbound on OPNsense is a resolving DNS server: it answers your devices' questions by asking the internet's DNS hierarchy, caches the answers, and — the part you feel daily — resolves your local names. Register DHCP leases and static mappings into DNS (options under Services → Unbound DNS → General in most versions) and printer.home starts working everywhere. For upstream behaviour you may simply leave the defaults; forwarding every query to one public resolver such as your ISP's or a public service is optional, not an upgrade by default.
Recent OPNsense versions ship Kea DHCP, the modern replacement for the old ISC DHCP server, which is now deprecated upstream. New installs should use Kea where it is offered: it is where development happens, and its lease and mapping screens are cleaner. If you are following an older guide or video that shows ISC DHCPv4 menus, do not panic — the concepts map one-to-one (pools, mappings, options), only the screens moved. Migrating an existing ISC setup is a deliberate, backed-up, one-time job, not something to click through at midnight.
Watch DHCP and DNS being set up in the video, including the leases page where static mappings are born.
▶️ Watch Full VideoUsually it makes no felt difference. OPNsense's Unbound resolves directly and caches heavily, which is as fast in practice and keeps queries distributed rather than sent to one company. Choose a forwarding resolver if you specifically want its filtering (for example a family-filtering DNS service), not for speed.
Renew its lease (reconnect Wi-Fi or restart the device) so DHCP and DNS re-register it, and check the leases page for stale entries or a duplicate static mapping. On the client, a cached answer is common — wait for the short local TTL or flush the client's DNS cache.
Yes. DHCP options can be set per pool and per static mapping in Kea, so for example the children's devices can receive a family-filtering resolver while everything else uses the firewall's own Unbound. Keep a written note of who gets what, or future debugging gets confusing.