Ok ... so I wasn't very happy with having the two tunnables set to one and felt like something was off, so I looked to redo the configuration.
Removed all configs from all interfaces, removed the bridge0 interface, deleted the bridge, and sat thinking about it for a while.
The tunnable for traffic to be filtered at the member interface makes all the sense to me.
I put WAN side rules on the OPT1 interface, and a OPT1_net to any rule on the OPT1 interface. OPT1 and OPT2 are bridged so the DHCP server configured at OPT1 will send broadcasts to all members.
So I did that. Configured the /28 on the OPT1 interface, enabled and configured the DHCP server. I also removed the net.link.bridge.pfil_bridge: 1 back to 0.
On the firewall added a rule with OPT1 net to any on the OPT2 interface.
After configuring OPT1 and DHCP Server, I created a new bridge with OPT1 and OPT2, assigned to a new interface and enabled.
After that and inspecting the traffic I saw two things:
a rule was needed at OPT2 to allow DHCP traffic;
the bridge interface was actively blocking traffic even tho the tunnable is set to zero.
Just to make sure, I enabled the DHCP rule on OPT2 first, and waited to see if it would still be blocked on the bridge, and it was. So seems like the option for the bridge doesn't work very well or didn't here. But anyway, after allowing any to any on the bridge, everything is working.
So the final config is:
opt1 (external)---¡ -> Static IP & DHCP Server enabled
|
| bridge0 -> firewall allow any to any
|
opt2 (internal)---! -> Allow DHCP traffic and OPT1_net to any
or more granular if preferred. Other rules go on the OPT1 interface like normal
In the end I don't know why I overcomplicated cause the final config seemed fairly simple, not sure what was missed before.