HOWTO: DHCP with bridged connections (1.2.1-RC1 and later)
-
Can I simply put 3 "any" in the rule, and then save and apply it? Any risk?
-
I had an Any to Any rule on my OPT1 interface and it still didn't work for my bridged interface (OPT1 and LAN).
To get it to work I followed Hagabard's instructions of allowing UDP port 67-68 BUT it needs to be the first rule in the list on the OPT1 interface.
UDP * 67 - 68 * 67 - 68 * pass dhcp traffic
Hope this helps others.
Duncan
-
Seems to be working without any firewall additions in 1.2.3, can anyone confirm that?
-
It's working if your're OPT1 rule is like this
because your'e passing everything including DHCP traffic.
I don't know why Pfsense doesn't allow DCHP traffic on Bridge connection automically. It just DHCP traffic anyway. I understand the reason why by default OPT1 traffic are block but DHCP should be auto since it's bridge right, just like for LAN.
-
I don't know why Pfsense doesn't allow DCHP traffic on Bridge connection automically. It just DHCP traffic anyway. I understand the reason why by default OPT1 traffic are block but DHCP should be auto since it's bridge right, just like for LAN.
pfSense does just what you tell it to.
If you dont create a rule telling it to allow DHCP it wont allow it.
Why should it automatically allow something?In fact this would be very bad.
I bridge in one of my setups my LAN(s) with the WAN(s) but i still have a DHCPs on the LAN(s).
(192.168.0.0/22 subnet on WAN, 4x 192.168.0.x/24 as /22 subnets)
Since outbound traffic is allowed i see quite a number of DHCP requests on my WAN(s).
I wouldn't want my DHCPs in the other subnets to answer any of these requests…. -
I don't know why Pfsense doesn't allow DCHP traffic on Bridge connection automically. It just DHCP traffic anyway. I understand the reason why by default OPT1 traffic are block but DHCP should be auto since it's bridge right, just like for LAN.
pfSense does just what you tell it to.
I think there is an inconsistency in configuring DHCP services and this has confused a number of users:
Firewall rules seem to be required for DHCP service only on bridged interfaces.
DHCP services are enabled by a tab under Services -> DHCP Server EXCEPT if the interface is bridged in which case you need to add firewall rules.I haven't tried this, but I wonder how one would configure DHCP service on OPT1 if OPT1 were bridged to LAN and DHCP service was to be disabled on LAN. I guess one would have to bridge LAN to OPT1 and then DHCP on OPT1 could be enabled by a tab under Services -> DHCP Server.
I can see that its useful to be able to control DHCP on individual interfaces but enabling DHCP on interfaces involved in a bridge is quite non-intuitive. I think new users would appreciate it if there was a consistent GUI interface for enabling DHCP service: To enable DHCP service on a physical interface do so through the appropriate tab under Services -> DHCP Server regardless of whether or not the interface was bridged.
-
If you bridge an interface with another one, you can no longer run a DHCP on it.
At least the tab under services –> DHCP server disappears.
Otherwise you'd have two DHCP servers on the same broadcast domain.I dont think it's inconsistant or confusing, just something to take into account when dealing with bridges.
Maybe a small note somewhere when enabling the bridge could appear. -
yes, maybe a note somewhere would be helpful. I was tearing my hair out trying to solve the DCHP issue when I bridge OPT1 with LAN until I read this thread. Now I'm bald. You see that note could have save me some hair.
-
I have a similar setup and tried your suggestion, but I'm still having issues. Does anyone have the definitive answer for getting DHCP working across bridged interfaces? Everything was working fine until I upgraded to 1.2.1.
Hello,
Similar and no succes. I dont wnow what i should do to make this working.
Using a NEW ALIX 2D3 and new install of embedded 1.2.3RC1.
-
Not working on last nanobsd snapshot…
-
Not working on last nanobsd snapshot…
You haven't given forums readers much information to work with.
What interfaces are you using? What is bridged with what? Does DHCP work on the "main" bridged interface (the one with an IP address)? Have you added the firewall rule for DHCP from the "secondary" bridged interface (the one without an IP address)? Have you checked the firewall logs to see if DHCP is blocked by the firewall?
-
Hello,
I am using ALIX 2D3 board.
I have:
WAN (vr0) DHCP 192.168.0.128
LAN (vr1) fixed 192.168.1.1
LAN2 (vr2 bridged on vr1) no ip
ath0 not activated yet, i want to solve vr1/vr2 before.WAN is receiving DHCP from my other router and it work.
Integrated DHCP is working well with LAN.
I have added the "famous" firewall rule in vr2 and no problem in log. If i suppress the rule, the firewall block: ok.
I have added a rule for all traffic pass in vr2. Also tested without it.
Here is an exemple of my config :http://diliak.pastebin.com/m6af426e9
You can see that i had'nt anything connected to vr1 and vr2. This explain the "no carrier".
I think, but i can be wrong, that when i connect my laptop on vr2, DHCP server send DHCP response on vr1.
I have tested 1.2.3RC1 embedded, 1.2.2 embedded and now i am with snapshot august 25 of nanoBSD 1.2.3RC2.
No success.
With fixed IP, vr2(LAN2) work well.
Thank's
-
I think, but i can be wrong, that when i connect my laptop on vr2, DHCP server send DHCP response on vr1.
Why do you think that? Have you done any traces?
I can't see anything obviously wrong with your configuration.
Long shot: When you had the laptop connected to vr2 was the link status active? Its possible you MIGHT need a crossover cable to connect the laptop to vr2 (or vr1 or vr0)!
-
I think, but i can be wrong, that when i connect my laptop on vr2, DHCP server send DHCP response on vr1.
Why do you think that? Have you done any traces?
It's because when y tested with my wlan (atho) bridged to lan(vr1), my laptop didn't have any DHCP reply. BUT, and it's funny, when i connected the cable LAN (vr1) on my laptop, it obtained DHCP reply from LAN AND FOR WLAN at the same time.
I can't see anything obviously wrong with your configuration.
Long shot: When you had the laptop connected to vr2 was the link status active? Its possible you MIGHT need a crossover cable to connect the laptop to vr2 (or vr1 or vr0)!
Yes it come active. And for cable, i dont think so because when i put fixed IP on laptop, it work well.
-
It's because when y tested with my wlan (atho) bridged to lan(vr1), my laptop didn't have any DHCP reply. BUT, and it's funny, when i connected the cable LAN (vr1) on my laptop, it obtained DHCP reply from LAN AND FOR WLAN at the same time.
I am having this exact issue, as soon as I plug the ethernet cable in, both it and the wifi get an IP.
Was any way around this found?
(new install of pfSense 1.2.3) -
If a member of a bridge is down, the whole bridge is down.
The old workaround to assign the wireless interface as LAN and bridge the wired interface as an OPT to it is still valid.
-
Or plug LAN into a switch. An Ethernet loopback plug used to work but didn't the last time I tried it (but my plug may have been bad).
-
If a member of a bridge is down, the whole bridge is down.
Hmm, really? This is very bad for me. ???
I have 10 interfaces on my pfsense box (firebox x-peak) 3 gig, 6 10/100 and 1 wireless.
Now I was planning to have 1 as wan 1 as DMZ, wifi isolated and the remaining interfaces bridged with lan. However if you're telling me that unless all 7 interfaces are up then it won't work I may have to rethink! ::)
I'm running 1.2.3 release embedded and have been struggling to get dhcp working across two bridged interfaces hence reading this thread.Steve
-
If a member of a bridge is down, the whole bridge is down.
That's not true as it's stated. What he's referring to is if the interface of the bridge that has the IP is down, then the bridge is still up and fine, but the gateway IP on the bridge will be inaccessible. i.e. if you bridge 5 interfaces to LAN, and LAN has the gateway IP for the subnet, if you unplug LAN you won't be able to get out to the Internet but the remaining functions of the bridge are fine. You have to ensure the interface of the bridge that has the IP is always up, the other interfaces are irrelevant.
In 2.0 you can assign the bridge itself and give it the IP so that isn't an issue.
-
Ah! Thanks. :)
That should be no problem then.Steve
