I would like pfSense to assign an IP address based on the MAC address of each container.

I tried everything I knew. I also tried assigning a custom MAC address via --mac-address in Extra Parameters: in Docker details.

I created a VLan on pfSense, and Unraid assigned IP addresses in order, I can't get pfSenese to take that role.

Here are a couple of screenshots of my setup, if you need anything else, I'll send it

Example. I would like the qBittorrent container to get the IP address 10.10.100.10 and to do that pfSense. Unraid persistently assigns the address 10.10.100.2

The screenshot shows the settings of Unraid, pfSense, and the command prompt from the Unraid terminal and Docker terminal as proof of the MAC address of the qBittorrent container.

Not possible. Docker can't talk to dhcp server.

You have 2 choices with docker on macvlan network.

1- you assign manually an address

2- you let docker assign an address but you have to make sure the range of docker network and your lan network don't overlap.

In your case you didn't assign a dhcp pool to your docker custom network. You have to assign manually an address to your container.

docker dhcp pool and pfsense dhcp pool are completly independant.

Thanks for the quick answer.

I found a topic on this forum that with the MAC address they fixed the IP address on Opensense. But there is no explanation of how it was done.

Apparently it can do the same on ProxMox. The custom MAC address assigneed to Container and the IP address is fixed for that MAC address in pfSens.

Nothing has to be done automatically. I would enter the MAC address into pfSense and based on that pfSense would assign an IP address for that Container.

18 minutes ago, neba said:

Nothing has to be done automatically. I would enter the MAC address into pfSense and based on that pfSense would assign an IP address for that Container.

Yes this works, you can statically assign an IP to a docker, and reserve the address in pfsense... I do this in my Unifi network.
You will need to use macvlan for Docker network type, using ipvlan will mean the mac address of container will be the host's mac address.

Also understand the mac is deterministically derived from the IP address, unless you define your own custom mac address for the container.

Edited November 3, 2025Nov 3 by tjb_altf4

Thanks, but I don't know what else to do. If you don't mind, take a look at the screenshots I posted.

Macvlan for Docker network type is set.

I did not understand the last sentence. Is it better to add a custom MAC address with the --mac-address=xx:xx:xx:xx:xx:xx option (somewhere it says that it must start at 02:42:xx:xx:xx:xx), or is it better that the Container itself assigns the MAC address during installation.

What does it mean that it is related to the IP address.

In the example above, I let the Container assign the MAC address itself, and it can be seen through two commands. There are screenshots

8 minutes ago, neba said:

Macvlan for Docker network type is set.

I did not understand the last sentence. Is it better to add a custom MAC address with the --mac-address=xx:xx:xx:xx:xx:xx option (somewhere it says that it must start at 02:42:xx:xx:xx:xx), or is it better that the Container itself assigns the MAC address during installation.

if you let docker assign its own mac, it will start with 02:42 (vendor portion of mac address), you don't need to override mac but it is an option.

8 minutes ago, neba said:

What does it mean that it is related to the IP address.

In the example above, I let the Container assign the MAC address itself, and it can be seen through two commands. There are screenshots

As above, first part of the mac is 02:42:0a, the rest is determined from its IP address it has been assigned, as explained here:

The MAC addresses for Docker all begin with 02:42.

The remaining four octets represent the IP address of the container in hex.

0xAC in hex is 172 in decimal,

0x11 is 17,

0x00 is, well, 0,

and 0x02 is... 2.

Thus this MAC address represents a container with the IP address 172.17.0.2. The default Docker bridge network is always given the IP range 172.17.0.0/16 by default, thus this would be the MAC address of the virtual Ethernet adapter given to the first container you run on a fresh Docker install.

If you change the IP address the mac will change, that was the point I was trying to make.

Great, thanks.

As far as I understand, if I want the IP address 10.10.100.10, I need to put the MAC address 02:42:0a:0a:64:0a.

What is the purpose of pfsense and the possibility for it to give me an IP address based on a MAC address?

Would have thought in pfsense under status > DHCP leases you could configure the IP assignment there by finding the one in question, then clicking the + symbol on the right and filling it out. If it's already built, you can find it under services > DHCP server, select the correct lan and looking at assignments at bottom of page.

4 minutes ago, Veah said:

Would have thought in pfsense under status > DHCP leases you could configure the IP assignment there by finding the one in question, then clicking the + symbol on the right and filling it out. If it's already built, you can find it under services > DHCP server, select the correct lan and looking at assignments at bottom of page.

That's right, with the fact that I manually entered the MAC address and IP address. I'm not sure that the DHCP leases show the MAC addresses of the Container.

Can compare the Mac address from ifconfig from the container console to the pfsense assignment Mac.

10 minutes ago, Veah said:

Can compare the Mac address from ifconfig from the container console to the pfsense assignment Mac.

It looks like everything is working like it should. All that needs changed is static mappings from .10 to .2 (in pfsense). Follow that with clearing your DHCP leases. Then restart container so it acquires new lease.

I'll give it a try

using custom br0 giving the dockers there own lan ip static and opening pfsense and asigning the dockers mac to the ip.

https://bmartino1.weebly.com/guide-dockernetworks.html

under docker settings you would want to use macvlan to get a mac for each docker in the custom br0 network


you can then grab the mac address form the docker via the network inspect command.

docker network ls
docker network inspect br0

eample my dns unboud docker is given this mac address in unifi I've infomred that this mac is this hostname and ip

you then use that data to propgate pfsense and store mac address data...

https://www.youtube.com/watch?v=jYZzAsPsyiQ

https://docs.netgate.com/pfsense/en/latest/captiveportal/mac-address-control.html

we used to be able to define a docker run command to set a custom mac address. Docker updates and cahgns now moved this to the dokcer network side so no more define dcoker continer to this premade mac address... macvlan randomly generates this...

that said... You can use docker compose and still pre define and set a mac address.

example:

docker compose to run unboud:

networks:
  br0:
    external: true
  # macvlan on your LAN. Must already exist via:
  #   docker network create -d macvlan \
  #     --subnet=192.168.2.0/24 --gateway=192.168.2.1 \
  #     -o parent=YOUR_NIC br0
  # (replace YOUR_NIC with e.g. eno1, eth0, etc.)
#uses unraids custom br0 default docker network

services:
  unbound:
    image: mvance/unbound:latest
    # Additional system control if needed...
    # sysctls:
    #   net.core.rmem_max: "16777216"
    # Memory budget for Unbound (cap + soft reservation)
    # mem_limit: 4g
    mem_reservation: 1g
    container_name: unbound
    restart: unless-stopped
    networks:
      br0:
        ipv4_address: 192.168.201.3
    mac_address: "##:##:##:##:02:04"

#I've written my own unboud and root hits location for this docker ... example only
    volumes:
      - /mnt/user/appdata/DNS/unbound/etc/unbound.conf:/opt/unbound/etc/unbound/unbound.conf
      - /mnt/user/appdata/DNS/unbound/key:/key

    # NOTE: Unbound is a full resolver and does not *need* upstream DNS here.
    # Keeping your original list below, but commented for later use if desired. Router Lan IP
    dns:
      - 192.168.201.1
    labels:
       net.unraid.docker.icon: "/mnt/user/appdata/DNS/unbound.png"
       folder.view: "DNS"
       net.unraid.docker.managed: "composeman"
    extra_hosts:
      # Dockers
      - "unbound:192.168.201.3"


    healthcheck:
      test: ["CMD-SHELL", "/opt/unbound/sbin/unbound-host -C /opt/unbound/etc/unbound/unbound.conf -t A example.com >/dev/null 2>&1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 10s

as example. AS I'm waiting for the push to convert and move unraid temaptel adn sytems over to Docker compose files...
Unraid temapte esentail builds a docer run line that gets excuted to make teh dockers on unraid...

we can use: https://www.composerize.com/

to convert them into compose file latter...

sharing as proff of concept with docker mac address manipulation...

46 minutes ago, neba said:

given this data you turned off bridging which is fine/OK. it just means you will use custom eth0 this is your ipvlan/macvlan router lan docker network.

so eth0 needs to connect to the pfsense device. unraind docker advance setting to move to macvlan to give dockers there own mac address is how i would direct you to move forward...

and this tells me your messing with vlans and have hit the docekr netwrok isoaltion issue

the vlan needs to have a dhcp server off pfsesne...

meaning if I connect to vlan 100 as shown here. I get a dhcp IP form pfsense on that vlan.

https://encrypted-vtbn1.gstatic.com/video?q=tbn:ANd9GcRN-XGWaNLzvwS_3harGp8nZhCPfDHmmx3oYCGD5nDNd3PcyHHR

server user define network and host access enabled in docker settings. I still recomend using the bridgin for br0 (unraid default configurations)
then we need to fix and doulbe check pfsesnt data for vlan and dhcp of a ip on that vlan...

then docuble check the vlan on unraid and make a docker network on that vlan

then asign that to the docker you wnat onthe vlan and get that mac to asign to pfsense...

as given the OG post and data shown it looks like unrad was setup corectly...

you will need pre check pfsense configurations for valns and the dhcp server over that vlan connection.

Netgate Forum

No DHCP on VLAN interfaces

I'm attempting to create a new VLAN configuration on pfSense 2.3.3, and can't get DHCP Server to configure. According to what I've been reading,  after confi...

Uh, thanks for such a detailed answer.

What I notice is that I set it up under docker settings:

Host access to custom networks: Disabled

Preserve user defined networks: No

Your advice is to be Enabled and Yes

1 hour ago, bmartino1 said:

the vlan needs to have a dhcp server off pfsesne...

meaning if I connect to vlan 100 as shown here. I get a dhcp IP form pfsense on that vlan.

That's right, and I think it's not pfsens, but the Unraid DHCP server assigns IP addresses.

That Docker doesn't reach pfsens.

I'll send the settings from pfsens later when I get home, and check everything you mentioned.

Thanks again

2 hours ago, neba said:

Uh, thanks for such a detailed answer.

What I notice is that I set it up under docker settings:

Host access to custom networks: Disabled

Preserve user defined networks: No

Your advice is to be Enabled and Yes

That's right, and I think it's not pfsens, but the Unraid DHCP server assigns IP addresses.

That Docker doesn't reach pfsens.

I'll send the settings from pfsens later when I get home, and check everything you mentioned.

Thanks again

Correct, please set custom to enabled and preserver user defined.

Host to enabled will fix some docker isolation issues and on reboot your custom docker network on br0.100 for example would not remain causing other networking issues upon reboot.

I want to make sure pfSense is correctly configured for vlans before editing and messing with unraid ...

we should be able to run a temp docker, something like docker run -network=eth0.100 bash
and consol in and double-check the docker on that vlan ...

I'm not set on where what broke where. I do know that there were a mis configuration write with unraid moving form v6 into v7 that messed with docker vlan pool settings. but if your vlan is not correct then edits on unraid won't fix the underline issue.

as we all need to make sure pfsense is routeing and able to tag the eth0 interface with multiple vlans...

as its possible to have vlan 100 tagged and pluged into unraid and have valn 100 act as the default vlan... so only eth0 is on vlan 100 but doesn't see vlan 100 so packets sent off unraid are bing redirected(pfsense configurations).

We want to make sure this isn't a network error first on pfsense. Then to infom unraid that a vlan exist and to tell linux to use eth0.100

we may need to remove the old bad docker data as well. as IDK what your settings curently are... Pleas post a diag!
Example, if you turned off bridging br0 doesn't exist and the docker you made for vlan 100 is now eth0.100 not br0.100 so the docker network needs recreated...

Not enuoth info to say one way or the other. but often when I jump in and help others on vlan stuff it has always been a network misconfiguration on how they have tagged there vlans in the router...

Edited November 3, 2025Nov 3 by bmartino1
spelling

Here are the settings in pfsense. I installed Unraid from scratch. I have only one Container installed and I will try with it.

The problem may be in the Switch.

On port 1 is pfsense (10.10.10.1)

On port 2 is Unraid (10.10.10.10)

On port 3 is a wifi AP (10.10.10.2)

correct layer 2 layer 3 with vlan tags. it could be I need time to go though your configurations and check. but atm this look good. The switch is a potental issue.

isp > pfsense > switch > unraid

pfsesne mutple dhcp servers setup with vlans
swithc port form pfsense port igc3 (this tells me the port is intel gigabit port #3...)
swithc port will need trunkign and or vlan taged to default valn 1 and other vlans you want unraid eth0 interface to interact with...

On 11/3/2025 at 9:17 PM, neba said:

What is the purpose of pfsense and the possibility for it to give me an IP address based on a MAC address?

Docker only uses its internal DHCP, if you want a specific IP for a container, you have to set it in the docker container template.

Pfsense (or any other router) cannot assign an IP to a docker container.

You are simply reserving the IP for the container in pfsense, so that pfsense doesn't hand out that address to another computer, which could happen when container is stopped.