I have a DHCP server set up on a L3 24port switch that connects to multiple routers that different clients connect to (hotel room scenario). With the dhcp on the switch everyone can see who is connected to the entire network if they look.

I only want devices connected to the same router to be able to see each other. (Can/should it be done from the L3 dhcp switch) or is it best to have dhcp done from the router?

  • 1
    Can you provide a simple diagram? Your description of multiple routers isn't quite clear.
    – Ron Trunk
    Jan 7 '17 at 19:28
  • 1
    Who is "everyone"? End users on their devices? And how can they "see who is connected"? Jan 7 '17 at 21:04
  • DHCP really has nothing to do with which hosts can communicate with which other hosts. That would be ACLs on the routers, or firewall(s).
    – Ron Maupin
    Jan 7 '17 at 21:35
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15 '17 at 17:44

If all you want to achieve is separate users from each other you can try setting Private VLAN or port isolation. This way each port can only communicate with gateway (uplink port). With such setup it does not matter whether DHCP server is directly on switch or external, but for flexibility reasons it is better to be external and just configure dhcp relay on switch to forward all requests to dhcp server.

Also if switch support "gleaning" to see DHCP transactions or DHCP lease query (RFC4388) it can even block all attempts of users to use unathorized IP addresses. For example on Mikrotik equipment you can use embedded DHCP server to put all DHCP clients into ARP tables directly and by turnning off arp responses it can force clients to only use DHCP assigned addresses.

This is theory. In practice it all depends on the actual hardware and software involved. By giving more info we can give you better answers with examples.


When you say 'everyone can see who is connected' who is everyone? The DHCP reservations on that switch should only be visible to the network admins and not end-users.

If you want to have local DHCP for each routed network, DHCP on each router is perfectly fine. From an administrative standpoint, this can be a burden since the DHCP reservations are not centralized for monitoring.

Ultimately, I want to make sure I'm reading your question correctly as no users would be able to 'see' other devices connected to other routers via DHCP. If access between networks is an issue then just block access with IPv4 access-lists.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.