Transparent Bridge Mode

[brianw90]

Hi Guys ! I need your help on configuring the PFSense in Transparent (bridge) mode.
I am trying to install PFsense on an ESXi box which is having two vSwitches.

1. Public
2. Pfsense (this is with no physical uplink, just a switch for VMs network traffic)

So, in pfsense they are treated as Public (WAN) and DMZ (LAN). So, what are the steps to achieve this ? I have been able configure successfully in previous verision 2.0.3. However, in the newer version, I am unable to pass the incoming traffic. Here are the steps which I am following :

Interfaces
>Assign
Bridges > Bridging b/w LAN and WAN
Interface Assignments
> OPT1
> Rename as BRIDGE
Interfaces
BRIDGE
> Enable Interface
Firewall
> NAT
> Outbound
Mode: Manual Outbound NAT rule Generation
Firewall
> Advanced
System > Tunables
net.link.bridge.pfil_bridge edit (1)
Interfaces
> LAN
Type: None >
Save

Am I doing anything wrong ? I have 20 VMs and want to assign public IPs on each VM. So, thinking to have PFSense implemented as Transparent firewall with firewall rules.

Can someone please help me to provide me the steps… Thanks in advance !

[doktornotor]

How about setting net.link.bridge.pfil_member to 0?

[stephenw10]

Do you actually want to filter on the bridge interface?

Normally in a transparent bridge you would filter on the member interfaces.

Check the firewall logs.

Steve

[brianw90]

Thanks for your response..

@doktornotor : I just made this change too.. however, still not resolved..

@stephenw10 : I am not sure if it should be bridge interface or member interface.. Earlier on 2.0 version, I used to follow this document and transparent bridge used to work. http://people.pharmacy.purdue.edu/~tarrh/Transparent%20Firewall-Filtering%20Bridge%20-%20pfSense%202.0.2%20By%20William%20Tarrh.pdf

I have ( /28 subnet) Public IPs assigned on an ESXi server network. I have to create 10 VMs and each will be assigned a Public IP. Right now, I have created a single server and assigned a public IP from the same subnet. I am able to access PFSense from its Public IP but not that Windows VM Server.Though, I have created rules on WAN > any source > destination : VM Server > any port. But I am still unable to ping or access this VM Server.

Any recommendation please ?

[stephenw10]

pfSense has an IP in that subnet also? Which interface is it on?

Do you see anything logged in the firewall log?

Run a packet capture on each interface for the server IP.

Steve

[brianw90]

Yes, PFSense has the same subnet IP on WAN interface. I can see the logs related to the WAN IP of Pfsense only. Nothing related to the other Public IP, which is assigned on the VM.

[stephenw10]

Ok, if you're putting the IP on the WAN there is no need to assign the bridge interface and you should leave the filtering sysctls at their defaults, filtering on the member interfaces.

Run a packet capture on the WAN for the server IP whilst you try to connect to it. You should see traffic coming in, at least ARP requests.

Run a packet capture on LAN for the same IP. You should see that same traffic there.

Steve

[hypemedia]

Hi
I am having the exact same problem did you found any solution for this?

[stephenw10]

Did you try the exact same tests with the exact same results?  ;)

It's probably better to start a new thread and detail exactly what you're trying to do, what you have tried and what the results were.

Bridging WAN to some internal interface to get public IPs there should be pretty straight forward. The troubleshooting in this thread should show you what is failing.

Steve

[hypemedia]

Hi yes I did the exact steps and the result is the same this is way I was writing here, but I can start a new thread if it is necessary. I now that bridge is easy from wan to internal interface (I have other 2 running without problems) but this one is not running and I don't know what to try anymore. The capture on the wan is not seeing any traffic related to the ip behind the bridge.

[stephenw10]

Ok so what do you see on the packet captures from each interface?

Do you see anything in the firewall logs?

What firewall rules do you have in place? I suggest adding allow all rules on both interfaces until you get it working.

Steve