Production deployments terminate client DHCP at network relays (switches, routers, or helper-address). Relays forward to the VIP that fronts the dhcpd processes. Lattice does not require a relay on every node.
Port
Relays must match the listen port: :67 in production, :6767 if that is what you bound in compose. DHCPv6 lab is :6754 (LATTICE_LISTEN_DHCP6).
Subnet selection for relayed packets uses giaddr. That address must sit inside a subnet CIDR you created in the plan. If dhcpd logs no subnet for packet, the helper address is wrong or the subnet row is missing.
Trusted relays
LATTICE_TRUSTED_RELAYS is a comma-separated list of IPs or CIDRs on the dhcpd process, not a field in the console.
- Empty (lab default): accept every source.
- Set in production: packets from other sources are dropped (
dropped untrusted relayin JSON logs). They get no Offer.
Example:
LATTICE_TRUSTED_RELAYS=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
make secure sets RFC1918 + loopback. There is no “trusted relays” table in IPAM.
See VIP for HAProxy UDP / keepalived. Health-check HTTP /readyz, not UDP/67.