Transparent Bridge Firewall - All Public IP Addresses
-
Yes all are enabled, although IP6 is not. Screen Shots attached.
So in short this part is missing from my config (from your paste) (obviously with my interfaces)
member: vr0 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 3 priority 128 path cost 200000
member: ath0_wlan0 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 11 priority 128 path cost 370370
</learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp> -
OK so it looks like there is a bug in the GUI, because it doesnt work…...
I did this from the command line (Source: http://www.freebsd.org/doc/handbook/network-bridging.html) and the Bridge is UP UP UP!!!!!
ifconfig bridge0 addm rl2 addm em0 up
ifconfig em0 up
ifconfig rl2 up
ifconfig bridge0
bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
ether aa:fc:23:10:64:e9
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: em0 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 2 priority 128 path cost 20000
member: rl2 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 5 priority 128 path cost 200000Thank you everyone for your help, nice to complete is post with a good answer…... although I must appologise for hijacking the orginal post.</learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></up,broadcast,running,simplex,multicast>
-
OK so it looks like there is a bug in the GUI, because it doesnt work…...
No, the GUI works fine, but it can only do what you tell it to. Your manual setup is completely different from what you configured in the GUI from the screenshots, you don't even have em0 assigned and it's not part of the bridge you setup. Which is also why your interface wasn't up until you manually upped it. It'll work fine if you configure it in the GUI so it does the back end the way you manually did it.
-
The GUI shows you attempting to bridge the PPP interface which is probably not a bridgeable interface. You also specified BRIDGE0 has a member DIGI which is the name assigned to BRIDGE0. A bridge probably can't have itself as a member :-)
I suspect you need to click on the "+" button on the Interfaces -> (assign) page twice to get two new pfSense interface names allocated, assign rl2 and em0 to those interface names and then make those new interfaces members of bridge0.
-
Would you care to expand on the procedure, your response is contridicatary to that of your colleague in the first part of the thread. I have this morning had to add another interface for the next part of the project and the bridge has gone. So I need to put it back, and it would be nice to put it back using the GUI.
Many many thanks for your help.
-
If the WAN NIC is added and bridged will traffic on it be routed via the PPPoE connection? I think perhaps not.
But agreed, you need to add an extra interface and assign em0 to it. Then replace DIGI in the bridge configuration with the new interface.
Steve
-
Now I'm getting extremely confused. Lets go back to basics here (Interfaces got changed due to a card addition):
I have a WAN interface (rl1) connected to our service provider.
I have another interface 'DIGI' (em0) connected to a DrayTek router which I want to expose directly to the internet allowing the Draytek to be allocated the public IP address.As I understand it I need to bridge the WAN (rl1) interface with the DIGI (em0) interface to make the Draktek accessible from the Internet via the assigned public IP.
We have established that I am using the correct Public IP address, subnet, gateway and DNS Servers.
Is this all correct?
What is the proceedure? -
OK. Assuming all previous screenshots etc are now redundant.
Create a bridge, bridge0, and add to it WAN(PPPoe0) and DIGI(em0).
Add a new interface and assign bridge0 to it.
As Wallabybob pointed out this is unusual, I'm not sure if a PPPoE interface can be part of a bridge but that' what I'd try first.
However in this configuration the PPPoE interface will always be given a public IP by Plusnet.
Do you have multiple public IPs?Steve
-
Create a bridge, bridge0, and add to it WAN(PPPoe0) and DIGI(em0).
Add a new interface and assign bridge0 to it.OK Done that, and it doesnt work, so either I am real thick, the instructions are incorrect, or the GUI is not doing what I ask of it.
As Wallabybob pointed out this is unusual, I'm not sure if a PPPoE interface can be part of a bridge but that' what I'd try first.
Is my approach completely wrong? Is there a better one?
If the WAN NIC is added and bridged will traffic on it be routed via the PPPoE connection? I think perhaps not.
OK this looks to me like it is going to be a problem? So I cannot pass traffic out from the Draytek, but I can receive?
However in this configuration the PPPoE interface will always be given a public IP by Plusnet.
Do you have multiple public IPs?I have a block of IP addresses yes, so thats not a problem.
Again if I add the bridge via the command line it springs straight up and traffic passes to my test box. As soon as I reboot the system though, the config is lost. Not sure how to commit it.
With my requirements all laid out, comments responded to what should I be doing cos my head is going to explode, after I have finished pulling my hair out and crying.
Thank you all so much…
-
I did this from the command line (Source: http://www.freebsd.org/doc/handbook/network-bridging.html) and the Bridge is UP UP UP!!!!!
I don't want to read too much into this statement - does it mean the configuration after executing the listed commands does everything you want it to do and nothing you don't want it to do?
Would you care to expand on the procedure, your response is contridicatary to that of your colleague in the first part of the thread.
I'll expand on the procedure if you give specific identification (author and reply number) of the "colleague" and response you mean.
Many many thanks for your help.
You're welcome.
If the WAN NIC is added and bridged will traffic on it be routed via the PPPoE connection? I think perhaps not.
Good point! I have no idea how bridging ppp and a lan interface will work. For example, what would ARP mean on a ppp interface?
As Wallabybob pointed out this is unusual, I'm not sure if a PPPoE interface can be part of a bridge but that' what I'd try first.
On my system:
$ ifconfig bridge1 create $ ifconfig bridge1 addm pppoe0 ifconfig: BRDGADD pppoe0: Invalid argument $ ifconfig bridge1 bridge1: flags=8802 <broadcast,simplex,multicast>metric 0 mtu 1500 ether de:86:fd:20:c4:7b id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200 root id 00:00:00:00:00:00 priority 0 ifcost 0 port 0 $</broadcast,simplex,multicast>Bridging PPP and lan is not allowed.
-
If the WAN NIC is added and bridged will traffic on it be routed via the PPPoE connection? I think perhaps not.
OK this looks to me like it is going to be a problem? So I cannot pass traffic out from the Draytek, but I can receive?
Sorry that's my fault just confusing things. :-[
Wallabybob suggested that it may not be possible to bridge the PPPoE connection and that you should use the WAN NIC instead. I was querying whether or not that would work. I still think it wouldn't.Perhaps you should re-describe what you are trying to achieve as an end result overall. Reading back through the thread why do you need the Draytek router at all?
Steve
-
So all said, how do I allocate the draytek a public IP and pass traffic to it directly without getting another adsl connection?
Lets get a high level understanding of what you are trying to do so we can determine the general solution. Then we can look at the specifics.
You said earlier you have a pool of public IP addresses. Would it be sufficient to pass some (or all) traffic to a specific IP address from the pool to the Draytek? Are all your public IPs on the same subnet or do you have a single public address allocated by PPP and a pool in another subnet?
Do you want ALL traffic from the internet to go to the Draytek? If so, why have the pfSense box?
-
We have a pool of ip addresses and all thankfully on the same subnet.
We have a pretty normal network setup, with a WAN adsl connection to plus.net, Wired LAN, Wireless network with Captive portal setup, DMZ with a web and mail server. Until now everything has been great, we NAT traffic if required for the standard mail and web stuff.
The new requirement is for a supplier that is housing equipment and setup in our building, their requirement is not negotiable. They have equipment tucked in behind a Daytek router and firewall. The WAN port needs exposure to the internet with a public IP address.
Hope that clarifys the requirement, and again thanks for your help guys.
-
For my research, and I don't know if I am 100% correct here. Bridging the WAN Interface with my DIGIEXPOSED interface is called a half-bridge, and committing it via the GUI does not work. (If I bridge two LAN interfaces it works fine).
It looks like the half-bridge will give incoming access not outgoing. If the supplier is using the connection to VPN in to their Draytek router will that give them going access through the VPN tunnel? Or am I being thick?
If I cannot commit a half-bridge through the GUI how do I commit the command line changes to the config so they become permanent?
ALSO I need access to the LAN side of the Draytek (10.x network) from a 192.x network, interfaces at in place. What would be the best approach for that?
Again, thank you all SO SO SO Much for your help.
Stu
-
Hmm, this is an interesting problem.
I can see why you might use the term 'half bridge', many router manufacturers seem to use it, but it has no meaning in FreeBSD (afaik). Though that is what you are trying to accomplish.
The bridge function is only restricted by the type of interface you are trying to bridge. If your WAN interface was DHCP this would be no problem. If you have got something working via the command line you should be able to replicate that in the GUI.If all that is required is to have access to the Draytek router from the internet then I would do as Wallabybob suggested; setup a virtual IP on WAN with one of your public IPs and 1:1 NAT that with the Draytek.
Do you have access to the Draytek configuration? What do you need to access on the 10.* network?
Steve
-
The pfSense has a discussion of using additional public IPs in section 6.7. One example (figure 6.21) shows use of a single block of IP addresses with the OPT1 interface bridged to WAN and a system connected to OPT1 having a public IP address.
That example assumes an internet connection from pfSense to the ISP router using IP over Ethernet. Your configuration uses IP over PPP over Ethernet and you can't bridge OPTx and WAN because WAN is a PPP interface.
Does your modem (upstream of pfSense) have the capability of handling the PPP so you can talk to it from pfSense using IP over Ethernet - that is, can you "offload" the PPP to the "modem"? If so, you can then bridge WAN and OPTx as discussed in the pfSense book.
Depending on the degree of NAT you are prepared to allow, you might be able to get by with the port forward configuration I hinted at earlier.
Maybe your modem will also accept IP over Ethernet and forward to the Internet inside the appropriate protocol wrapper. If so, you could possibly bridge your OPTx interface and the physical interface on which the WAN interface operates.
-
"offload" the PPP to the "modem", I think you are right, thats where the problem is. I will confirm on Sunday when I can get in and take everything offline.
Thanks for your help
-
1:1 NAT it is! I have it up on the https port and can see the Draytek.
One cable running from the PFSense DIGIEXP (exposed) interface into the WAN port of the DrayTek. Just have to add the other rules so they can VPN into it.
The next thing I need to do is allow access to the LAN side of the DrayTek (DIGIINT, 10.61.88.0/28) from the existing LAN (192.168.1.0/24).
-
Good job! :)
The next thing I need to do is allow access to the LAN side of the DrayTek (DIGIINT, 10.61.88.0/28) from the existing LAN (192.168.1.0/24).
I can't see how you are going to do this without adding some rules to the Draytek. Unless you bypass it completely with another connection - which could open up the possibility of horrible routing loops!
VPN tunnel perhaps?Unless the Draytek router already allows access to the servers behind it (seems likely ::)) in which case you just need to add a static route to pfSense so it knows where to send traffic for 10.61.88.0/28.
Steve
-
YEP I know, I know. The requirements of this company are stupid, really really stupid. Why they could not use our existing infrastructure is crazy. And to expect it from a small charity….. well...
Essentially the remote access via the 1:1 NAT on the first part of the project is to allow the company that installed to manage, they come into their DrayTek via the Public IP and VPN on the Draytek.
The second portion of the project access the to LAN portion on the Draytek is for usage of the product, they will not allow us to use the public side.. mental isn't it?
