HOW TO - EASY (wireless) bridge configuration in 2.0
-
Followed this tutorial. I have 4 Lan ports bridged to LAN.
I can access the internet from all of my devices connected to the ports and I can access each device from the WAN. However, the devices can't talk to each other. I have even tried adding firewall rules to each of the individual interfaces.
Any suggestions.
-
Followed this tutorial. I have 4 Lan ports bridged to LAN.
. . .
If this is still an issue I suggest you start a new topic. I suspect it might have got lost in the sticky topic with wireless in the title. I usually don't even look at the sticky topics because they don't tend to change much.
-
I just wanted to add a note that for this type of bridge configuration, sometimes it is useful to assign a MAC address to the bridge interface. Normally it just gets a random MAC, but this behavior will cause some client systems to notify that you are connecting to a new network or router every time it gets a new random MAC (each time you boot up the router), potentially requiring some kind of firewall setup steps for the new network. Setting a fixed MAC address on the bridge interface resolves this (MAC address on bridge members is ignored in the type of setup this topic is about).
-
I just tried this, and it hung at step 6. I had to use the local console to reset my interfaces.
Also, I don't see a picture showing the Advanced changes that need to be made.
-
Hi,
I have tried that setup with some differences and can't make it work…
My goal is to:- have a wireless with a vlan tag (not the wifi interface but with a bridge based on the lan interface)
- have a dhcp server for the wifi network
For what I understand, I need to
LAN -> BRIDGE0 -> vlan100 on em1 -> em1
-> em2 (the phy interface exist but will not be used, just for the bridge to work)dhcp enable on LAN
and
WIFI -> BRIDGE1 -> vlan200 en em1 -> em1
-> ath0dhcp on WIFI interface
Does this make sense? Any advices to make this setup work?
Thanks
-
My goal is to:
- have a wireless with a vlan tag (not the wifi interface but with a bridge based on the lan interface)
If I recall correctly this is not supported: I don't think FreeBSD supports VLANs on any wireless interface. (Feel free to check the FreeBSD vlan man page.)
In pfSense 2.0 there is support for multiple wireless networks on a single physical interface, provided the interface driver supports that. (Some drivers do support it and some don't.)
What are you trying to accomplish by this combination?
-
In fact I do not try to tag the wifi ath0 interface but tag the lan interface and use it with a bridge to have my wifi tagged this way. I managed to make it works with 1.2.3 but I can't in RC1.
My goal is to- tag with a vlan my lan and wifi traffic and have a dhcp server that deliver ips for the wifi and lan network with differents addresses.
Hope it's clearer.
-
Some possible problems with this sort of configuration: when forwarding from VLAN to wireless does the bridge strip the VLAN tag? If wireless client sees a VLAN tag in an incoming frame does it ignore the VLAN altogether (and process the frame) or does it ignore the frame on the grounds of "I don't support VLANs so this mustn't be for me"? When forwarding from wireless to VLAN should the bridge add a VLAN tag? If it doesn't how will the frame be processed at the receiving end?
Neither the FreeBSD vlan man page nor the bridge man page say what the bridge will do to VLAN tags when you bridge a VLAN and non-VLAN so I would guess the FreBSD developers might feel free to change the behaviour at any time and not feel a need to document the change.
I think you will be on much firmer ground if you don't mix VLAN and non VLAN interfaces on a bridge.
-
Hi,
Thanks for those very good advices and they all make sense.
Since I have question:- If I configure one port of my vlan capable switch to only accept vlan traffic, then wireless devices could not connect to the hosts that are filtered by the switch..
Any suggestion?
A big thank for your help.
Romain
- If I configure one port of my vlan capable switch to only accept vlan traffic, then wireless devices could not connect to the hosts that are filtered by the switch..
-
- If I configure one port of my vlan capable switch to only accept vlan traffic, then wireless devices could not connect to the hosts that are filtered by the switch..
Sorry, I don't understand this description.
Here's a simplified concept description of my configuration. Perhaps this will help.
I have a ProCurve 1700-8 VLAN capable switch.
My pfSense box has physical interfaces ath0 (Wireless LAN), vr0 (LAN) and rl0. ath0 and vr0 are bridged. On rl0 I have VLANS with IDs 10 and 15. rl0 connects to port 7 on the switch. port 7 on the switch is configured as a member of VLAN 10 and VLAN 15. port 6 on the switch is the only other member of VLAN 10 and that connects to my ADSL modem. port 3 on the switch is the only other member of VLAN 15 and connects to a server. My WAN interface is pppoe on vlan 10 on rl0. My OPT3 (DMZ) interface is vlan 15 on rl0.
The switch ports are configured:
port 3 VLAN Aware Enabled=NO Ingress Filtering enabled=NO Packet Type=ALL PVID=15
port 6 VLAN Aware Enabled=NO Ingress Filtering enabled=NO Packet Type=ALL PVID=10
port 7 VLAN Aware Enabled=YES Ingress Filtering enabled=NO Packet Type=Tagged PVID=None -
Thanks for for comments
I use at home a ProCurve 1800-8GI have a ProCurve 1700-8 VLAN capable switch.
My pfSense box has physical interfaces ath0 (Wireless LAN), vr0 (LAN) and rl0. ath0 and vr0 are bridged. On rl0 I have VLANS with IDs 10 and 15. rl0 connects to port 7 on the switch. port 7 on the switch is configured as a member of VLAN 10 and VLAN 15. port 6 on the switch is the only other member of VLAN 10 and that connects to my ADSL modem. port 3 on the switch is the only other member of VLAN 15 and connects to a server. My WAN interface is pppoe on vlan 10 on rl0. My OPT3 (DMZ) interface is vlan 15 on rl0.
The switch ports are configured:
port 3 VLAN Aware Enabled=NO Ingress Filtering enabled=NO Packet Type=ALL PVID=15
port 6 VLAN Aware Enabled=NO Ingress Filtering enabled=NO Packet Type=ALL PVID=10
port 7 VLAN Aware Enabled=YES Ingress Filtering enabled=NO Packet Type=Tagged PVID=NoneOk I have read several times your post and still do not understand all the subtilities… Myabe because englsih is not my mother tongue ;-)
Let me resume:
ath0 and lan (vr0) are bridge. Fine. dhcp should gives IP for LAN and wifi. But no vlan here
Your WAN is vlan 10 or rl0
You also have have an interface for vlan15 on rl0 (DMZ)
But where your LAN (vr0) connects on the switch?
Is your wifi traffic tagged by the switch and are you able to go to your vlan'ed machines/servers with your wireless connection?Thanks again for your precious advices
-
ath0 and lan (vr0) are bridge. Fine. dhcp should gives IP for LAN and wifi. But no vlan here
Your WAN is vlan 10 or rl0
You also have have an interface for vlan15 on rl0 (DMZ)Correct.
But where your LAN (vr0) connects on the switch?
LAN doesn't use VLANs at all. The pfSense LAN port connect to a separate switch which is not VLAN capable.
Is your wifi traffic tagged by the switch and are you able to go to your vlan'ed machines/servers with your wireless connection?
No and yes.
-
I found my missing step. I needed to redo the LAN ip configuration. After that, everything seems to be working.
-
Okay, so I have LAN and WLAN bridged together. But I can't seem to get a firewall rule to work that will block traffic from WLAN to LAN. I want to block everything by default and only allow certain ports and ips access. What do I need to configure on my firewall in order to do this?
-
On my system I had to specifically enable DHCP traffic from WAN to LAN, otherwise it was blocked (quietly, if I recall correctly). So I think firewall rules on WLAN should be able to accomplish what you want. (Firewall rules apply on input.)
However, you should note that after tweaking with firewall rules it is sometimes necessary to reset firewall states to have the modified rules apply. I always (when I remember) reset firewall states after changing firewall rules. See Diagnostics -> States, click on Reset states tab for more information.
-
I ended up turning filtering on interfaces back on. Once I did that, my firewall rules worked.
EDIT: I take it back. I can get DHCP on both LAN and WLAN. Both of them can get out to the internet. But they won't talk to each other. And this is with no additional rules enabled.
-
@Bai:
I just tried this, and it hung at step 6. I had to use the local console to reset my interfaces.
Also, I don't see a picture showing the Advanced changes that need to be made.
Same here. It took me a while to work this out but if you select LAN + WIFI in your bridge then it doesn't work, you need to select OPT2, WIFI or whatever you've called your wifi.
-
@Bai:
I just tried this, and it hung at step 6. I had to use the local console to reset my interfaces.
Also, I don't see a picture showing the Advanced changes that need to be made.
Same here. It took me a while to work this out but if you select LAN + WIFI in your bridge then it doesn't work, you need to select OPT2, WIFI or whatever you've called your wifi.
I also had to resetup the lan dhcp server from the console. See my post above yours.
-
Hi,
Yes, it still works. I'm on a snapshot from April 18th. I'll be testing the May 1st 2G Nano snapshot in the next hour.
I am running the latest RC1 build (April 11 2011) and I am trying to get Wireless to work. Unfortunately there does not appear to be any way to add another interface in the GUI, or at least if there is I can't seem to see it. I am stuck with the 3 physical interfaces (dc0 - WAN, nfe0 - LAN and ral0 - WLAN).
EDIT: After some playing around I managed to get it to work. I created a bridge between LAN and WLAN first, then I was able to create the OPT2 interface and set it to the bridge. Enabled OPT2, then went back to the assign page and shuffled the assignments around. Lastly I rebooted the pfSense machine. And now it all works.
My problem now is that my clients will connect at ~36mbps, but that drops to 1mbps almost instantly and stays there. Could this be a hardware issue? The client laptop is sitting about 4 feet from the pfSense machine, with nothing in between them.
Thanks for the help.
-
I am using 2.0 RC 1, I can't get the bridge functions to work correctly. I am using a WatchGuard 500x.
RC