Filtered Bridge Configuration for v2.0.1 - Only Two Interfaces (LAN/WAN)
-
Hello all-
I'm having trouble locating a good document for configuring a filtered bridge for version 2.x, and most of the configurations I can find seem to be for setups with three physical interfaces (where one can be reserved for management). I'm trying to make due with two. I have a cable modem with a block of 5 usable public IPs. When done I'm hoping it can operate as follows…
1. Cable modem connected to pfSense WAN
2. pfSense LAN to connected to small switch
3. Hosts connected to switch can be assigned public IPs from the cable modem subnet and access the Internet without NAT. All outbound traffic is permitted. Inbound traffic to those hosts should be controlled by rules.
This seems like it should be simple but I'm really struggling with it. I've bridged the LAN/WAN interfaces together, disabled NAT and set the pfil_bridge to 1. I have no DHCP. I've found various configurations where hosts behind the firewall can go outbound and I've used wireshark on an external host to verify that NAT is off. However, I've not been able to permit any inbound traffic from the WAN side. Here are a couple of things I'm really unclear on...
-
Which of the pfSense interfaces should have IP addresses (I tried several combinations) and which should I be using for management (I've been using the LAN, Bridge or both - Generally have had no IP assigned to the WAN interface)
-
On which interface (WAN, LAN or Bridge) should I be creating rules for access the hosts behind the firewall?
Any help would be appreciated. I'm wondering if this is even possible with just two physical interfaces. If I am able to sort this out I'd happily draft a step-by-step for others.
Thanks!
-
-
I had the same issue, many hours of googling led me to http://forum.pfsense.org/index.php?topic=37824.0 – which worked great, the only step missing was to bridge the LAN and WAN which you have already done!
-
I had the same issue, many hours of googling led me to http://forum.pfsense.org/index.php?topic=37824.0 – which worked great, the only step missing was to bridge the LAN and WAN which you have already done!
Thanks for the heads up. someone else pointed out I missed that step, I am going to add that in tonight.