The isc-dhcp-server (Internet Systems Consortium DHCP Server) daemon is a powerful service used in Ubuntu Server to dynamically assign IP addresses, subnet masks, and default gateways to client machines on a network. It is an essential component if your Ubuntu box is acting as the primary router or gateway for an entire subnet (like in a homelab or a dedicated networking closet). However, if your Ubuntu Server is simply a node on a network (like a web server or a database) that receives its own IP from a corporate firewall or an upstream router, running a DHCP server locally is not only useless, but it can also cause catastrophic IP conflicts and take down the entire network by acting as a rogue DHCP server.
This guide explains how to completely disable the isc-dhcp-server daemon in Ubuntu Server.
Stop and Disable the DHCP Server Daemon
To ensure the server never accidentally broadcasts DHCP offers or leases IPs to connected clients, we must halt the daemon and explicitly mask it via systemd.
- Log into your Ubuntu Server via SSH or local console using an account with
sudoprivileges. - First, stop the active service to immediately halt any IP address leasing:
sudo systemctl stop isc-dhcp-server.service - Next, disable the service so it does not attempt to initialize during the next system boot sequence:
sudo systemctl disable isc-dhcp-server.service - To guarantee that no other networking script or misconfigured interface can accidentally wake the daemon, mask the service unit entirely:
sudo systemctl mask isc-dhcp-server.service
Verify the Daemon Isolation
By masking the service, you guarantee that the DHCP leasing subsystem is entirely inert, protecting the rest of your network from rogue IP assignments.
To verify the lockdown is successful, run the following command to check the status of the daemon:
systemctl status isc-dhcp-server.serviceThe output will clearly state that the service is masked (symlinked to /dev/null) and the Active state will read inactive (dead). If you run sudo ss -ulnp | grep 67, you will confirm that the server is no longer listening on UDP port 67, confirming that the dangerous rogue DHCP vector has been completely eradicated.