Will pfSense pass through VLAN tagged traffic in transparent firewall mode?

radicd · May 4, 2012, 1:15 PM

I'm looking to add a pfSense firewall in between a router and switch with vlan tagging setup on the router and just placing a transparent firewall in between without any additional configuration. Would there be any problems passing through the vlan tagged traffic?

Current setup:

Router (vlan tagged traffic) > brocade switch

Looking to get the following in production:

Router (vlan tagged traffic) > pfSense (transparent firewall) > brocade switch

k6usy · May 4, 2012, 6:53 PM

You just need to setup the vLANs on both NICs of the pfsense box. Then assign the vLANs to interfaces and setup the rules.

radicd · May 4, 2012, 7:15 PM

Thanks for the reply, but I'm trying to avoid maintaining VLANs in the firewall. I would like pfSense to act as nothing more than a firewall and have the VLANs configured in the router.

Is the setup I mentioned in the original post possible?

cmb · May 4, 2012, 8:16 PM

I believe the behavior of if_bridge is it will pass through the 802.1Q tags. Some searching indicates that's been broken at some past points but that predates the base version we're on.

k6usy · May 4, 2012, 9:35 PM

@radicd:

Thanks for the reply, but I'm trying to avoid maintaining VLANs in the firewall. I would like pfSense to act as nothing more than a firewall and have the VLANs configured in the router.

Is the setup I mentioned in the original post possible?

How many vLANs do you have?

radicd · May 4, 2012, 10:22 PM

@cmb:

I believe the behavior of if_bridge is it will pass through the 802.1Q tags. Some searching indicates that's been broken at some past points but that predates the base version we're on.

Thanks, going to do some internal testing and I will confirm back.

radicd · May 4, 2012, 10:23 PM

@k6usy:

@radicd:

Thanks for the reply, but I'm trying to avoid maintaining VLANs in the firewall. I would like pfSense to act as nothing more than a firewall and have the VLANs configured in the router.

Is the setup I mentioned in the original post possible?

How many vLANs do you have?

Too many, 50+ on each switch and constantly being modified.