Ethernet rules L2 capable interface

jeffvfren · Oct 10, 2024, 4:08 AM

How do I check if the interfaces are L2 capable before switching to pfSense Plus?

ibg 1000baseT <full-duplex>

https://docs.netgate.com/pfsense/en/latest/firewall/ethernet-rules.html#layer-2-interfaces

Warning
The firewall will not generate an error if the user attempts to apply an Ethernet rule on an interface which is not capable of L2. These rules can never be matched as a non-L2 interface is not capable of triggering Ethernet rules.

johnpoz · Oct 10, 2024, 5:21 AM

@jeffvfren "As a general rule, if an interface has a MAC address, then it is capable of carrying L2 data."

What they are warning about is you can't do ethernet rules on an interface you create for something.. I have never seen an actual physical interface that would be..

edit: example... do a ifconfig, see how these interfaces have no mac

ovpns1: flags=1008043<UP,BROADCAST,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=80000<LINKSTATE>
        inet 10.0.8.1 netmask 0xffffff00 broadcast 10.0.8.255
        inet6 fe80::208:a2ff:fe0c:e624%ovpns1 prefixlen 64 scopeid 0x10
        groups: tun openvpn
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        Opened by PID 19881
ovpns2: flags=1008043<UP,BROADCAST,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=80000<LINKSTATE>
        inet 10.0.200.249 netmask 0xfffffff8 broadcast 10.0.200.255
        inet6 fe80::208:a2ff:fe0c:e624%ovpns2 prefixlen 64 scopeid 0x11
        groups: tun openvpn
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        Opened by PID 25055
ovpnc3: flags=1008043<UP,BROADCAST,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1500
        options=80000<LINKSTATE>
        inet 172.27.224.15 netmask 0xfffff000 broadcast 172.27.239.255
        inet6 fe80::208:a2ff:fe0c:e624%ovpnc3 prefixlen 64 scopeid 0x12
        groups: tun openvpn
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        Opened by PID 30234
tailscale0: flags=1008043<UP,BROADCAST,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1280
        options=80000<LINKSTATE>
        inet 100.101.219.121 netmask 0xffffffff broadcast 100.101.219.121
        inet6 fd7a:115c:a1e0::ee25:db79 prefixlen 48
        groups: tun Tailscale
        nd6 options=101<PERFORMNUD,NO_DAD>
        Opened by PID 80759

But see a physical interface..

igb0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: LAN
        options=4e100bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>
        ether 00:08:a2:0c:e6:24
        inet 192.168.9.253 netmask 0xffffff00 broadcast 192.168.9.255
        inet6 fe80::208:a2ff:fe0c:e624%igb0 prefixlen 64 scopeid 0x1
        inet6 2001:470:c0ee:9::253 prefixlen 64
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

Has a mac address
ether 00:08:a2:0c:e6:24

jeffvfren · Oct 10, 2024, 5:29 AM

@johnpoz Thank you, that really cleared things up.