Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense with 3 NICS

    Scheduled Pinned Locked Moved General pfSense Questions
    75 Posts 7 Posters 17.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      Dude how is anything going to use pfsense if pfsense has no VIRTUAL nic in the switch??

      How is any VM going to connect to pfsense lan1 or lan2 if there is NOTHING connected to the vswitch?  Does not matter if the vswitch is not connected to the physical world or not..

      See bottom of my virtual network from esxi

      See how pfsense has a virtual interface connected into the vswitch, so that other virtual machines with a virtual interface connected to this vswitch can connect to pfsense and then access the real world (internet or lan or wlan) via the physical nics connected to those vswitches.

      You have nothing connected to your lan1 or lan2 from your drawing - no pfsense interfaces, no vms – so NO how would anything use it..  What does pfsense show for its interfaces, since from your drawing you don't show any lan1 or lan2 interfaces for pfsense at all.

      So for example

      
      [2.1.1-PRERELEASE][admin@pfsense.local.lan]/root(1): ifconfig
      em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
              options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:00:00:02
              inet 192.168.1.253 netmask 0xffffff00 broadcast 192.168.1.255
              inet6 fe80::250:56ff:fe00:2%em0 prefixlen 64 scopeid 0x1
              inet6 2001:470:1f11:9c4::1 prefixlen 64
              nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
              status: active
      em1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
              options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:00:00:01
              inet 24.13.xx.xx netmask 0xfffff800 broadcast 255.255.255.255
              inet6 fe80::250:56ff:fe00:1%em1 prefixlen 64 scopeid 0x2
              nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
              status: active
      em2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
              options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:1e:18:90
              inet 192.168.2.253 netmask 0xffffff00 broadcast 192.168.2.255
              inet6 fe80::20c:29ff:fe1e:1890%em2 prefixlen 64 scopeid 0x3
              nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
              status: active
      em3: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
              options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:1e:18:9a
              inet 192.168.3.253 netmask 0xffffff00 broadcast 192.168.3.255
              inet6 fe80::20c:29ff:fe1e:189a%em3 prefixlen 64 scopeid 0x4
              nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
              status: active</full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast> 
      

      Those are the interfaces in my virtual pfsense.. Se how pfsense has 4 interfaces.  One in each segment (wan, lan, wlan, dmz) notice how in my esxi network pfsense is listed as having a connection in each vswitch that is connected to each one of pfsense interfaces.  If I connect a virtual machine to that vswitch, via a virtual interface.  Like the W7 machine on the bottom above pfsense on the dmz vswitch.. It can talk to pfsense over the vswitch on its dmz virtual interface and then pfsense can route it to any of its other interfaces over virtual - which may or may not have access into the physical world via a physical adapter connected to that vswitch.

      pfsensemissing.png
      pfsensemissing.png_thumb
      pfsenseconnected.png
      pfsenseconnected.png_thumb

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • J
        Jamerson
        last edited by

        @johnpoz:

        Dude how is anything going to use pfsense if pfsense has no VIRTUAL nic in the switch??

        How is any VM going to connect to pfsense lan1 or lan2 if there is NOTHING connected to the vswitch?  Does not matter if the vswitch is not connected to the physical world or not..

        See bottom of my virtual network from esxi

        See how pfsense has a virtual interface connected into the vswitch, so that other virtual machines with a virtual interface connected to this vswitch can connect to pfsense and then access the real world (internet or lan or wlan) via the physical nics connected to those vswitches.

        You have nothing connected to your lan1 or lan2 from your drawing - no pfsense interfaces, no vms – so NO how would anything use it..  What does pfsense show for its interfaces, since from your drawing you don't show any lan1 or lan2 interfaces for pfsense at all.

        So for example

        
        [2.1.1-PRERELEASE][admin@pfsense.local.lan]/root(1): ifconfig
        em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:00:00:02
                inet 192.168.1.253 netmask 0xffffff00 broadcast 192.168.1.255
                inet6 fe80::250:56ff:fe00:2%em0 prefixlen 64 scopeid 0x1
                inet6 2001:470:1f11:9c4::1 prefixlen 64
                nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active
        em1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:00:00:01
                inet 24.13.xx.xx netmask 0xfffff800 broadcast 255.255.255.255
                inet6 fe80::250:56ff:fe00:1%em1 prefixlen 64 scopeid 0x2
                nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active
        em2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:1e:18:90
                inet 192.168.2.253 netmask 0xffffff00 broadcast 192.168.2.255
                inet6 fe80::20c:29ff:fe1e:1890%em2 prefixlen 64 scopeid 0x3
                nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active
        em3: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:1e:18:9a
                inet 192.168.3.253 netmask 0xffffff00 broadcast 192.168.3.255
                inet6 fe80::20c:29ff:fe1e:189a%em3 prefixlen 64 scopeid 0x4
                nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active</full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast> 
        

        Those are the interfaces in my virtual pfsense.. Se how pfsense has 4 interfaces.  One in each segment (wan, lan, wlan, dmz) notice how in my esxi network pfsense is listed as having a connection in each vswitch that is connected to each one of pfsense interfaces.  If I connect a virtual machine to that vswitch, via a virtual interface.  Like the W7 machine on the bottom above pfsense on the dmz vswitch.. It can talk to pfsense over the vswitch on its dmz virtual interface and then pfsense can route it to any of its other interfaces over virtual - which may or may not have access into the physical world via a physical adapter connected to that vswitch.

        hi John,
        Let me thank you for your continue help really appreciate it.
        apologies i've uploaded the wrong screenshot !
        the attached is the correct screenshot

        when a machine using LAN1 NIC as Gateway is not accessible the internet !

        em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:a8:1a:4a
                inet 192.168.2.3 netmask 0xffffff00 broadcast 192.168.2.255
                inet6 fe80::250:56ff:fea8:1a4a%em0 prefixlen 64 scopeid 0x1
                nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active
        em1: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:8c:7e:c8
                inet 192.168.4.1 netmask 0xffffff00 broadcast 192.168.4.255
                inet6 fe80::250:56ff:fe8c:7ec8%em1 prefixlen 64 scopeid 0x2
                nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active
        em2: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:8c:a6:3b
                inet 192.168.6.0 netmask 0xffffff00 broadcast 192.168.6.255
                inet6 fe80::250:56ff:fe8c:a63b%em2 prefixlen 64 scopeid 0x3
                nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active
        plip0: flags=8810 <pointopoint,simplex,multicast>metric 0 mtu 1500
        pflog0: flags=100 <promisc>metric 0 mtu 33144
        lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
                options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000
                inet6 ::1 prefixlen 128
                inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
                nd6 options=3 <performnud,accept_rtadv>pfsync0: flags=0<> metric 0 mtu 1460
                syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
        enc0: flags=0<> metric 0 mtu 1536
        bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                ether 02:1b:ed:00:ce:00
                id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
                maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
                root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
                member: em2 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 3 priority 128 path cost 20000
                member: em1 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 2 priority 128 path cost 20000
        ovpns1: flags=8051 <up,pointopoint,running,multicast>metric 0 mtu 1500
                options=80000 <linkstate>inet6 fe80::250:56ff:fea8:1a4a%ovpns1 prefixlen 64 scopeid 0xa
                inet 192.168.200.1 --> 192.168.200.2 netmask 0xffffffff
                nd6 options=3 <performnud,accept_rtadv>Opened by PID 10306</performnud,accept_rtadv></linkstate></up,pointopoint,running,multicast></learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></up,broadcast,running,simplex,multicast></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></promisc></pointopoint,simplex,multicast></full-duplex></performnud></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,promisc,simplex,multicast></full-duplex></performnud></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,promisc,simplex,multicast></full-duplex></performnud></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast> 
        

        LAN1.jpg
        LAN1.jpg_thumb

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Well for one this address is wrong

          inet 192.168.6.0 that you have on em2

          That is a network (wire address) with that mask netmask 0xffffff00 (/24 or 255.255.255.0) not a host or interface address.  I would think it should be 192.168.6.1 - so fix that for starters.

          Now on lan2, connect some Vms.  Did you post the wrong drawing again - there are no other vms connected to vswitch2 or lan 2 in your drawing - so how is anything expected to connect to pfsense lan2 interface.  Same with lan1 - there are NO other vms there either. Did you not understand my last post?

          Once you have a vm actually connected to lan2 vswitch, and give pfsense an actual valid host IP that you want to use for the network you put it on.. Can the clients connected to that vswitch on the same network as pfsense interface ping it?  What are the firewall rules for that interface.  While the first lan you create when pfsense is installed will have a any any rule on it and allow outbound traffic to anywhere.  When you add additional interfaces there will be NO rules, and you have to allow the traffic you want out on this new network segment.  So what are you rules on lan2?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            You have bridge0 containing both em1 and em2. They both have static IP addresses in different subnets. Are they both running dhcp? (Is that possible?). You have bridged the two subnets so that they both exist across both network segments. I'm fairly sure you don't want to do that.

            Steve

            1 Reply Last reply Reply Quote 0
            • D
              doktornotor Banned
              last edited by

              I cannot see any pfSense anywhere on the networking diagrams you posted. Really dunno what you are trying to do there. When nothing's connected, nothing will work. Other than that - flush the mess you have created down the drain, and produce a barebones basic setup with 3 NICs. No "teaming", "bridging" and similar nonsense.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Good catch.. Didn't even get that far in his listing

                bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                        ether 02:1b:ed:00:ce:00
                        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
                        maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
                        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
                        member: em2 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 3 priority 128 path cost 20000
                        member: em1 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 2 priority 128 path cost 20000

                I just don't get it.. You really just click click and pfsense works out of the box – its like these users go out of their way to have issues.. Why would he have created a bridge??  When clearly he mentions multiple segments.  And he seems to have a hard time posting actual info that is what his network is..  How do you not notice that what you posts shows NOTHING connected to your vswitches? ;)</learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></up,broadcast,running,simplex,multicast>

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • J
                  Jamerson
                  last edited by

                  @stephenw10:

                  You have bridge0 containing both em1 and em2. They both have static IP addresses in different subnets. Are they both running dhcp? (Is that possible?). You have bridged the two subnets so that they both exist across both network segments. I'm fairly sure you don't want to do that.

                  Steve

                  Hi Stephen
                  LAN2 has a DHCP enable and the machines recieves the IP from the DHCP server
                  192.168.6.11
                  255.255.255.0
                  192.168.6.1

                  @doktornotor:

                  I cannot see any pfSense anywhere on the networking diagrams you posted. Really dunno what you are trying to do there. When nothing's connected, nothing will work. Other than that - flush the mess you have created down the drain, and produce a barebones basic setup with 3 NICs. No "teaming", "bridging" and similar nonsense.

                  ASA Firewall is the PFSENSE on the diagrame,
                  i havent created any Teaming yet. i am just trying to get the VM to access the internet without Physical NIC attached to the Vswitch on the ESXI
                  @johnpoz:

                  Good catch.. Didn't even get that far in his listing

                  bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                          ether 02:1b:ed:00:ce:00
                          id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
                          maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
                          root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
                          member: em2 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 3 priority 128 path cost 20000
                          member: em1 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 2 priority 128 path cost 20000

                  I just don't get it.. You really just click click and pfsense works out of the box – its like these users go out of their way to have issues.. Why would he have created a bridge??  When clearly he mentions multiple segments.  And he seems to have a hard time posting actual info that is what his network is..  How do you not notice that what you posts shows NOTHING connected to your vswitches? ;)</learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></up,broadcast,running,simplex,multicast>

                  i have created a vm and attached to LAN2 with LAN2 NIC of PFSENSE
                  and still can't get to the internet
                  i didnt really created any bridg connection, probably it out of the box ?

                  Win7.jpg
                  Win7.jpg_thumb
                  route-print.jpg
                  route-print.jpg_thumb

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    @Jamerson:

                    i didnt really created any bridg connection, probably it out of the box ?

                    No, there is absolutely NO bridge created out of the box. As already suggested quite some time ago, reset the config to factory defaults and start from scratch, with a simple setup, and do not do anything else until you understand the consequences.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      @Jamerson:

                      i didnt really created any bridg connection, probably it out of the box ?

                      Not any time I've installed pfSense.  ;) Though I've never used the OVA preconfigured VM.
                      I too would not expect to see a bridge interface unless you have deliberately created one.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        There is NO bridge out of the box that is for SURE!!  You must of created it - delete that!!

                        And your saying your clients are getting this via dhcp

                        192.168.6.11
                        255.255.255.0
                        192.168.6.1

                        Well so 6.1 is your gateway?  But pfsense doesn't have an IP on 6.1 via your ifconfig – it has .0 as its address.. Which is the WIRE and not a valid host IP for your mask of /24

                        em2: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                                options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:8c:a6:3b
                                inet 192.168.6.0 netmask 0xffffff00 broadcast 192.168.6.255
                                inet6 fe80::250:56ff:fe8c:a63b%em2 prefixlen 64 scopeid 0x3
                                nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                                status: active</full-duplex></performnud></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,promisc,simplex,multicast>

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • J
                          Jamerson
                          last edited by

                          @johnpoz:

                          There is NO bridge out of the box that is for SURE!!  You must of created it - delete that!!

                          And your saying your clients are getting this via dhcp

                          192.168.6.11
                          255.255.255.0
                          192.168.6.1

                          Well so 6.1 is your gateway?  But pfsense doesn't have an IP on 6.1 via your ifconfig – it has .0 as its address.. Which is the WIRE and not a valid host IP for your mask of /24

                          em2: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                                  options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:8c:a6:3b
                                  inet 192.168.6.0 netmask 0xffffff00 broadcast 192.168.6.255
                                  inet6 fe80::250:56ff:fe8c:a63b%em2 prefixlen 64 scopeid 0x3
                                  nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                                  status: active</full-duplex></performnud></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,promisc,simplex,multicast>

                          the 192.168.6.0 i fixed it,
                          the LAN 2 NIC was assigned with the wrong IP 192.168.6.0 but now it's 192.168.6.1
                          can you direct me how to create the bridg between the two LAN ?

                          em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                                  options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:a8:1a:4a
                                  inet 192.168.2.3 netmask 0xffffff00 broadcast 192.168.2.255
                                  inet6 fe80::250:56ff:fea8:1a4a%em0 prefixlen 64 scopeid 0x1
                                  nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                                  status: active
                          em1: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                                  options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:8c:7e:c8
                                  inet 192.168.4.1 netmask 0xffffff00 broadcast 192.168.4.255
                                  inet6 fe80::250:56ff:fe8c:7ec8%em1 prefixlen 64 scopeid 0x2
                                  nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                                  status: active
                          em2: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                                  options=98 <vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:50:56:8c:a6:3b
                                  inet6 fe80::250:56ff:fe8c:a63b%em2 prefixlen 64 scopeid 0x3
                                  inet 192.168.6.1 netmask 0xffffff00 broadcast 192.168.6.255
                                  nd6 options=1 <performnud>media: Ethernet autoselect (1000baseT <full-duplex>)
                                  status: active
                          plip0: flags=8810 <pointopoint,simplex,multicast>metric 0 mtu 1500
                          pflog0: flags=100 <promisc>metric 0 mtu 33144
                          lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
                                  options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000
                                  inet6 ::1 prefixlen 128
                                  inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
                                  nd6 options=3 <performnud,accept_rtadv>pfsync0: flags=0<> metric 0 mtu 1460
                                  syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
                          enc0: flags=0<> metric 0 mtu 1536
                          bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                                  ether 02:1b:ed:00:ce:00
                                  id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
                                  maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
                                  root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
                                  member: em2 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 3 priority 128 path cost 20000
                                  member: em1 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 2 priority 128 path cost 20000
                          ovpns1: flags=8051 <up,pointopoint,running,multicast>metric 0 mtu 1500
                                  options=80000 <linkstate>inet6 fe80::250:56ff:fea8:1a4a%ovpns1 prefixlen 64 scopeid 0xa
                                  inet 192.168.200.1 --> 192.168.200.2 netmask 0xffffffff
                                  nd6 options=3 <performnud,accept_rtadv>Opened by PID 10306</performnud,accept_rtadv></linkstate></up,pointopoint,running,multicast></learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></up,broadcast,running,simplex,multicast></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></promisc></pointopoint,simplex,multicast></full-duplex></performnud></vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,promisc,simplex,multicast></full-duplex></performnud></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,promisc,simplex,multicast></full-duplex></performnud></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast> 
                          
                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by

                            @Jamerson:

                            can you direct me how to create the bridg between the two LAN ?

                            Huh?! You already have one even though you should NOT have any as there's no reason for that!

                            
                            bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                                    ether 02:1b:ed:00:ce:00
                                    id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
                                    maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
                                    root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
                                    member: em2 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 3 priority 128 path cost 20000
                                    member: em1 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 2 priority 128 path cost 20000</learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></up,broadcast,running,simplex,multicast> 
                            

                            Are you actually listening to what people are writing here? WHY do you want to create yet another bridge?  :o

                            1 Reply Last reply Reply Quote 0
                            • J
                              Jamerson
                              last edited by

                              @doktornotor:

                              @Jamerson:

                              can you direct me how to create the bridg between the two LAN ?

                              Huh?! You already have one even though you should NOT have any as there's no reason for that!

                              
                              bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                                      ether 02:1b:ed:00:ce:00
                                      id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
                                      maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
                                      root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
                                      member: em2 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 3 priority 128 path cost 20000
                                      member: em1 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 2 priority 128 path cost 20000</learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></up,broadcast,running,simplex,multicast> 
                              

                              Are you actually listening to what people are writing here? WHY do you want to create yet another bridge?  :o

                              i already answer this will be for testing, thank you .

                              LAN1 is production and LAN2 is for testing

                              1 Reply Last reply Reply Quote 0
                              • D
                                doktornotor Banned
                                last edited by

                                Well, dude… this goes nowhere. WHAT are you testing with a setup that is totally FUBARed and you refuse any advise to get it fixed? You already bridged 2 out of 3 LANs, so what else do you want to bridge and WHY? . Like, some real reason what you expect from that. No, "it's for testing" is NOT any reason that makes sense. You have already tested that your setup does not work.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  And you would not "bridge" between "production" and "testing"..  You might bridge between physical segment that you need to extend into different locations - using 1 address network block.  You would not bridge 2 different networks segments.  That is utter nonsense..

                                  And as already pointed out you already have one - which you say you didn't create..  WTF dude??  delete it - or better yet.  Just wipe this pfsense vm completely and start over with a download iso you boot your new vm to and install.  You should have nice clean setup with what you want to do it like 5 minutes top..  Out of the box you have to do like 3 things - set your wan static, change your lan to your ip range you want to use vs the default 192.168.1.0/24 and then create your 2nd segment and put in the any any firewall rule on this lan2 segment.  There your done!!

                                  Then you can start testing - what I have no idea..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    Jamerson
                                    last edited by

                                    @johnpoz:

                                    And you would not "bridge" between "production" and "testing"..  You might bridge between physical segment that you need to extend into different locations - using 1 address network block.  You would not bridge 2 different networks segments.  That is utter nonsense..

                                    And as already pointed out you already have one - which you say you didn't create..  WTF dude??  delete it - or better yet.  Just wipe this pfsense vm completely and start over with a download iso you boot your new vm to and install.  You should have nice clean setup with what you want to do it like 5 minutes top..  Out of the box you have to do like 3 things - set your wan static, change your lan to your ip range you want to use vs the default 192.168.1.0/24 and then create your 2nd segment and put in the any any firewall rule on this lan2 segment.  There your done!!

                                    Then you can start testing - what I have no idea..

                                    John thank you so much for your continu support.
                                    i will use a Physicall NIC to LAN 2.
                                    really appreciate all your support guys.
                                    and apologies if i caused any furstration !

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      Physical nic??  What??  Dude are you on medication or something?

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Try to remain calm.  ;D

                                        We are somewhat going around in circles here.

                                        Jamerson, what is your final goal here? Could you describe, perhaps with a diagram, what you are hoping to achieve.

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          Dude this guy is just loopy..  He is either off his medication or on some, or english is not his native language is only thing that explains this nonsense.

                                          As to what he is trying to achieve, isn't it clear ;)  "i am using all my 3 NICS to use Teaming so all traffic will go thought the WAN."

                                          So either stoned or not a native speaker is my guess ;)  I really want to help the guy - but its getting a bit ridiculous, maybe he is just trolling and having a good laugh?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            podilarius
                                            last edited by

                                            I am sure he doesn't know what bridging and teaming are. So it would seem that others don't either. It looks like he is wanting a routed solution. teaming in VMWare, Windows, and linux is akin to LAGG in pfSense. Bridging is completely different.
                                            On LAN and LAN2, please unset the Gateways. Turn off blocking of private and bogons on LAN and LAN2. Not on WAN unless WAN network is private. Then if you changed from autoNAT, turn it back on unless you plan on some expert configuration.

                                            Create an two aliases. One that has the LAN subnet in there 10.0.10.0/24 and another Alias that has LAN2 subnet in it (192.168.2.0/24). Then create an rule in LAN (or modify the existing one) that states Any proto, from LAN subnet, any port ::: to ::: !LAN2 Subnet (the alias you created) on any port ::: Allow.
                                            Create a similar rule on LAN2 that allows any traffic NOT going to LAN to pass.
                                            This will block LAN and LAN2 from communicating.

                                            Hope that helps.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.