What is a cloud-based DHCP server?
Let's start by defining what a DHCP server is. A DHCP server (Dynamic Host Configuration Protocol server) is a network service that automatically assigns IP addresses and other network settings to devices on a network, ensuring reliable connectivity and reducing manual configuration. The protocol was first standardized by the Internet Engineering Task Force (IETF) in RFC 2131.
A cloud-based DHCP server performs the same function but is hosted in the cloud rather than on a local server. This approach is especially beneficial for organizations with distributed networks or those that need to scale their infrastructure quickly and efficiently.
How cloud DHCP works
DHCP's core exchange hasn't changed since RFC 2131: a client broadcasts a request, and a server responds with a lease. What changes in a cloud deployment is how that exchange crosses the distance between a branch office and a DHCP engine that isn't on the local network.
The DORA process
Every DHCP transaction follows four steps, commonly shortened to DORA:
- Discover: the client device broadcasts a DHCPDISCOVER message on its local network segment, looking for any available DHCP server.
- Offer: a DHCP server responds with a DHCPOFFER, proposing an IP address and lease terms.
- Request: the client replies with a DHCPREQUEST, formally asking for the offered address.
- Acknowledge: the server confirms with a DHCPACK, and the lease is active.
The broadcast problem. DHCPDISCOVER is a Layer 2 broadcast; it doesn't travel past the local subnet, let alone across the internet to a cloud region. A device at a branch office physically cannot broadcast to a DHCP server sitting in the cloud.
The relay agent bridges the gap. This is solved with a DHCP relay agent (also called an IP helper), which runs on the local router, switch, or SD-WAN appliance. The relay agent listens for the local broadcast, wraps it in a unicast packet, and forwards it to the cloud DHCP server's address, typically over an IPsec tunnel or private connection. The cloud engine processes the request, allocates an address from the correct scope, and sends the response back through the same relay path to the client. The client never talks to the cloud directly, and it never needs to know DHCP isn't local.
Why this matters for guest and IoT traffic. Because every request passes through the cloud engine before a lease is issued, that same checkpoint can inspect the request, apply policy, and log the device before it gets network access, which is what makes cloud DHCP a natural fit for onboarding untrusted and unmanaged devices at scale.
DHCP server fundamentals: core components explained
What is a DHCP server?
The DHCP server is the go-to device for responding to DHCP requests, allocating available addresses, and subsequently storing them during their lease periods.
What is a DHCP relay agent?
First device on the local network that picks up a client's request, typically a router, switch, firewall or SD-WAN appliance. It captures the device's local broadcast, adds its own address so the server knows which site and subnet the request comes from, and forwards it to the DHCP server. When the response comes back, it delivers it to the client.
What is a DHCP client?
Every client device, from computers to mobiles and Internet of Things (IoT) devices, will require a DHCP client. This component is responsible for requesting an IP address and communicating with the server to ensure that it receives said address and all other pertinent data associated with this process.
What is a DHCP scope?
DHCP scope encompasses a range of IP addresses, which are then allocated by the DHCP server to its clients.
What is a subnet?
Splitting a network into smaller subsections is referred to as subnetting. By doing this, you can easily manage different parts of the same network and create more efficient communication among its users.
What is an IP lease?
An IP lease is the length of time a client can use an assigned IP address before it must renew or release it.
What is a DHCP relay?
As the communicator between the DHCP server and its client, the relay interprets messages and channels them to their appropriate destination.
What is a Domain Name System (DNS)?
The Domain Name System (DNS) is a distributed directory that translates domain names (example.com) into IP addresses. It lets users and devices reach websites, cloud applications and services by name instead of by number. DNS works hand in hand with DHCP: when a device joins the network, the DHCP server tells it which DNS servers to use, so it can start browsing right away.
What is an IPsec tunnel?
IPsec tunnels enable users to securely connect across networks, encrypting packets of information as they travel from one IP address to another. The security architecture is defined by the IETF in RFC 4301.
Why use a cloud-based DHCP server?
A cloud-based DHCP server provides several benefits, including scalability, reliability, and cost savings.
Cloudi-Fi's cloud-based Captive Portal platform provides a comprehensive suite of tools to secure and simplify internet access management across multiple locations, ncluding offices, retail stores, manufacturing sites, and transportation fleets. The platform extends DHCP server functionality to the cloud, enabling centralized network control without on-premises infrastructure. Cloudi-Fi acts as a secure gateway to the internet by authenticating untrusted devices and users, assigning unique IP addresses, and ensuring safe connectivity. It also delivers analytics and dashboards to monitor network activity, user behavior, and location performance.
A cloud-based DHCP service available to onboard unknown and, therefore, untrusted IoT devices allows network administrators to configure and scale public and guest Wi-Fi networks efficiently compared to location-based physical DHCP servers.
Enabling DHCP service capabilities may increase the load on your network, as each device that connects will need to request an IP address from the DHCP server. Consider setting up DHCP reservations to ensure that specific devices receive the same IP address.
The Cloudi-Fi cloud-based DHCP management functionality already helps complex organizations manage the load and generate the required IP addresses for connecting devices.
Device fingerprinting for IoT visibility
Because every DHCP request passes through Cloudi-Fi's cloud engine, it can inspect DHCP Option 55 (Parameter Request List) and Option 60 (Vendor Class Identifier) to identify a device's type, brand, and operating system before it's granted network access. This gives administrators automated IoT and BYOD device visibility at the point of connection, rather than after the fact.
As untrusted IoT devices multiply, managing their IP addresses site by site with local DHCP servers no longer scales; IoT Analytics' State of IoT 2026 report puts connected IoT devices at 18.5 billion in 2024, projecting 21.9 billion by the end of 2026. Delivering a reliable cloud-based DHCP service will be key for modern organizations that want to secure their network against potential attacks introduced by these devices.
Key benefits of a cloud-based DHCP server
- Scalability: A cloud-based DHCP server can scale quickly and easily to meet the changing needs of your organization.
- Reliability: A cloud-based DHCP server is highly reliable and hosted in a secure, redundant environment.
- Cost savings: A cloud-based DHCP server can save you money compared to hosting a DHCP server on-premises, as you only pay for the resources you use.
Cloudi-Fi aims to assist its customers with these three cloud security benefits, as the rise of IoT devices trying to connect to Wi-Fi networks will only increase in the months and years ahead.
Setting up a cloud-based DHCP server: step-by-step guide
1. Prerequisites for your DHCP server
Before setting up your cloud-based DHCP server, it is essential to understand the basics of networking and have some experience with cloud computing and virtualization. Understanding DHCP, DNS, and your specific cloud provider is also helpful.
2. Creating DHCP scopes and options on the server
DHCP scopes are an essential part of setting up cloud DHCP servers. A DHCP scope is the IP address range within a network that is available for assignment to network devices. Only the IP addresses in the defined DHCP scope can be used to assign IPs to clients on the network.
The subnet mask, gateway address, and DHCP lease time can also be specified within the scope, along with additional settings such as DNS servers and default option values.
3. Step-by-step guide for setting up a cloud-based DHCP server
- Choose your cloud provider.
- Create a virtual machine (VM) in the cloud to host your DHCP server.
- Install an operating system on your VM.
- Install DHCP server software on your VM.
- Connect your location to the DHCP VM through an IPsec tunnel or private network, this may require specific firewall configurations.
- Set up external monitoring.
- Provision your location's resources (IP subnets and DHCP parameters).
- Test the end-to-end service and your DHCP server.
Cloudi-Fi avoids the need to go through all these complex steps and simplifies the process by only requiring the user to provision its locations through a user-friendly admin panel, making it easy to set up your cloud-based DHCP server.
Configuring your DHCP server for guests, BYOD and IoT
DHCP is particularly useful for unmanaged guests. Untrusted guest devices require internet access. Our cloud-based DHCP will assign them the required IP address centrally, enabling the global organization to regain control of local site administration while consuming fewer network resources and reducing local hardware maintenance and potential failure.
Before collecting information about your existing DHCP service, it is essential to correctly configure Cloudi-Fi's cloud-based DHCP service. This includes:
- The IP address range
- The gateway address
- DNS server addresses
- Other settings related to the existing DHCP service
Write down all this information before proceeding with the next steps.
Configure DHCP on the network and location
Once you have all the necessary information about your existing network, it's time to start setting up Cloudi-Fi's DHCP service for guests. To do this, log into the admin portal and select "Network" and "Location" from the dropdown menu.
Enter all of the parameters for your existing network and save the settings:
- Tunnel: Client IP: list of IPs with which to create a tunnel to the DHCP server.
- Subnet: the IP range to use for new guests, and Relay: the IP of the DHCP relay routing traffic to the actual DHCP server (default gateway).
- DHCP Leases Management: lease duration for unauthenticated users, and extended lease duration for users already authenticated.
- Pool: start and end address: the first and last IP that can be used in the subnet.
- Options: the information shared in the DHCP response, including the default gateway and DNS the guest user needs to use.
4. Build the IPsec VPN tunnel between your location and the cloud DHCP
Your local router or firewall connected to the DHCP client should act as a DHCP relay agent so that it can forward DHCP requests from the client to Cloudi-Fi's DHCP server across an IPsec tunnel. Recommended settings for the IPsec tunnel are available in Cloudi-Fi's help center.
Once you've saved these settings, connect a device to your network and confirm it was assigned an IP address from within your configured range. If so, you're ready to activate Cloudi-Fi's DHCP service for guests on your network.
What are the next steps?
Once you have set up a cloud-based DHCP server, there are several next steps to consider:
1. Monitor and optimize your DHCP server
Use tools like Cloudi-Fi's network analytics to monitor your network usage and identify potential issues, and ensure the server functions correctly and efficiently.
2. Configure DHCP reservations
Set up DHCP reservations for specific devices on your network, such as servers or printers, so they always receive the same IP address; helping maintain network stability and consistency.
3. Set up DHCP options
DHCP options let you specify additional settings provided to devices when they request an IP address, such as DNS server addresses, domain name search lists, and default gateway addresses.
Cloudi-Fi cloud-based DHCP is the secure gateway for any unmanaged resources or devices connecting to the network. A cloud-based DHCP service will also help modern organizations implement Zero Trust Network Access (ZTNA) frameworks to onboard massive volumes of untrusted IoT devices, significantly reducing manual administration. See how it works in practice in our banking group case study on centralized guest Wi-Fi and DHCP management.
