Networks and DHCP

The Network tab's Local network group holds two sections:

• VLANs and DHCP lists every network on the firewall with its DHCP scope, address usage, and connected devices. This is where you add and change networks.
• Leases and ARP is a read-only view of the firewall's gateways, DHCP leases, and ARP and NDP tables.

To make changes here, the firewall needs Allow network changes from ReadyView turned on. See How changes work.

#VLANs and DHCP

Each network appears as a row with:

• its name (the ReadyView name, if you gave it one, then the firewall's name), with badges such as WAN, VLAN 30, or Disabled;
• link status: Up, Down, No link, or Missing;
• where it lives and its address, for example "VLAN 30 on igc1 · 192.168.30.1/24";
• its DHCP scope: pools, DNS servers, lease time, and reservations. A network without DHCP shows "No DHCP scope: devices here need a static address."

#Address usage

Under each DHCP scope, a bar shows how full it is, for example "180 of 254 addresses used · 74 free · 71% (150 leased, 30 reserved)". The bar changes colour at 75% and again at 90%. A full scope means new devices can't get an address. Make the pool larger, shorten the lease time, or remove stale reservations.

#Devices on a network

Click Devices (n) under a network to see the devices on it. Each device shows whether it's online, how it got its address (DHCP, Reserved, or Static), and when its lease ends. From a device row you can click Reserve address to keep its current address.

#Add a VLAN network

1. Click Add network.
2. Under What is this network for?, choose Devices on your network.
3. Pick the port (or LAGG) and the VLAN tag, 1 to 4094, the same tag your switches carry.
4. Enter a Name on the firewall (letters, digits, and _ only) and an optional VLAN description.
5. Enter the firewall's IPv4 address on the network, with its prefix, for example 192.168.30.1/24.
6. To hand out addresses, tick Hand out addresses with DHCP and set:
   • Address pool: up to 16 ranges;
   • DNS servers: up to 8, or leave empty to use the firewall itself (needed for the DNS filter);
   • Lease time (seconds): leave empty for the server's default.
7. Click Create.

If ReadyView says "The firewall's DHCP server (Kea) is off", turn on Services > Kea DHCP in the firewall's web interface first.

#Edit or delete a network

Click Edit on the row, change what you need, and click Save. Deleting a network removes its interface, VLAN, DHCP scope, reservations, and the firewall rules on that interface. ReadyView asks you to confirm.

Some rows can't be changed here, and say why:

• "A physical port, not a VLAN: change it on the firewall."
• "An uplink (it has a gateway or a dynamic address): change it on the firewall."
• "Part of an interface group or bridge, so it can't be deleted here."

If the firewall has changes of its own waiting to be applied in its web interface, every button is disabled until someone applies or undoes them there.

#DHCP reservations

A reservation always gives the same address to a device's MAC address.

1. Click Add reservation on a network, or Reserve address on a device row.
2. Enter the MAC address, the IPv4 address (inside the network's subnet), and optionally a Hostname and Description.
3. Click Save.

A device already on the network gets its reserved address the next time it renews its lease or reconnects. ReadyView refuses a reservation that duplicates a MAC, falls outside the subnet, uses the network or firewall address, or uses an address another device is leasing right now.

Removing a reservation doesn't disconnect the device. It keeps its address until the lease ends. Reservations keyed by DHCP client ID instead of MAC are read-only in ReadyView.

#Add a second internet connection

You can add a WAN for dual uplinks without touching the firewall's own interface.

1. Click Add network and choose Internet connection (WAN).
2. Choose On a free port (a port with nothing assigned, where you plug in the modem) or On a VLAN.
3. Under Internet connection, choose Get an address from the modem (DHCP), or Fixed address and enter the Address and Gateway.
4. Leave Block private networks and Block bogon networks ticked unless your provider says otherwise. Optionally set an Address to ping to monitor the connection.
5. Click Create, then Go to Uplinks to set up failover or load balancing.

The new WAN blocks incoming traffic from the internet, and ReadyView adds no rules for it. ReadyView won't delete a WAN while it carries the default route, is part of dual uplinks or a gateway group, or is used by a route.

#Move a VLAN to another port or LAGG

In a VLAN's Edit form you can move it to another port or LAGG. It keeps its interface, address, DHCP scope, and rules. The tag can't change.

Before you save, make sure the switch on the new port carries the VLAN. Devices that reach the network through the old port lose it. If the firewall manages itself through that VLAN and loses ReadyView after the move, it puts the VLAN back by itself within about a minute.

#Port settings and LAGGs

The Port button on a network moves its interface to another port or LAGG, and sets MTU, Speed and duplex, and MAC address. Leave MAC address empty unless your provider expects a particular address. Hardware offloads are shown read-only; change them under Interfaces > Settings on the firewall.

The ports list shows each port with badges: ReadyView marks the port the firewall reaches the cloud through, Uplink an internet port, Free an unused port.

To bundle ports:

1. Click Add LAGG.
2. Tick up to 8 Ports. They must be free (no interface, VLAN, or PPP link on them).
3. Choose a Protocol: LACP, Failover, Load balance, or Round robin. For Failover, choose the Primary port.
4. Optionally set Fast LACP timeout, Spread traffic by (L2, L3, L4), MTU, and a Description.
5. Click Save.

Configure the switch with the same ports in a LAGG of its own. A LAGG with an interface or VLANs on it can't be deleted.

#Rename ports in ReadyView

Click the pencil next to a port or network to give it a name that's shown everywhere in ReadyView, for example "Core switch uplink". The firewall keeps its own name. Renaming needs permission to update firewalls but no setting on the firewall.

#Leases and ARP

This read-only section shows, straight from the firewall:

• Gateways: each gateway's status (Online, Offline, Degraded, Pending), delay, loss, and the address it pings. "Not monitored: the firewall doesn't check whether this gateway answers" means monitoring is off; turn it on in Uplinks.
• DHCP leases, ARP, and NDP tabs, with a search box (address, MAC, or name) and interface filters. Permanent entries are the firewall's own addresses or static entries; they never age out.

From a lease row, Policies lets you block the device or add it to a group policy.

#Common messages