Transparent Bridge Mode
-
How about setting net.link.bridge.pfil_member to 0?
-
Do you actually want to filter on the bridge interface?
Normally in a transparent bridge you would filter on the member interfaces.
Check the firewall logs.
Steve
-
Thanks for your response..
@doktornotor : I just made this change too.. however, still not resolved..
@stephenw10 : I am not sure if it should be bridge interface or member interface.. Earlier on 2.0 version, I used to follow this document and transparent bridge used to work. http://people.pharmacy.purdue.edu/~tarrh/Transparent%20Firewall-Filtering%20Bridge%20-%20pfSense%202.0.2%20By%20William%20Tarrh.pdf
I have ( /28 subnet) Public IPs assigned on an ESXi server network. I have to create 10 VMs and each will be assigned a Public IP. Right now, I have created a single server and assigned a public IP from the same subnet. I am able to access PFSense from its Public IP but not that Windows VM Server.Though, I have created rules on WAN > any source > destination : VM Server > any port. But I am still unable to ping or access this VM Server.
Any recommendation please ?
-
pfSense has an IP in that subnet also? Which interface is it on?
Do you see anything logged in the firewall log?
Run a packet capture on each interface for the server IP.
Steve
-
Yes, PFSense has the same subnet IP on WAN interface. I can see the logs related to the WAN IP of Pfsense only. Nothing related to the other Public IP, which is assigned on the VM.
-
Ok, if you're putting the IP on the WAN there is no need to assign the bridge interface and you should leave the filtering sysctls at their defaults, filtering on the member interfaces.
Run a packet capture on the WAN for the server IP whilst you try to connect to it. You should see traffic coming in, at least ARP requests.
Run a packet capture on LAN for the same IP. You should see that same traffic there.
Steve
-
Hi
I am having the exact same problem did you found any solution for this? -
Did you try the exact same tests with the exact same results? ;)
It's probably better to start a new thread and detail exactly what you're trying to do, what you have tried and what the results were.
Bridging WAN to some internal interface to get public IPs there should be pretty straight forward. The troubleshooting in this thread should show you what is failing.
Steve
-
Hi yes I did the exact steps and the result is the same this is way I was writing here, but I can start a new thread if it is necessary. I now that bridge is easy from wan to internal interface (I have other 2 running without problems) but this one is not running and I don't know what to try anymore. The capture on the wan is not seeing any traffic related to the ip behind the bridge.
-
Ok so what do you see on the packet captures from each interface?
Do you see anything in the firewall logs?
What firewall rules do you have in place? I suggest adding allow all rules on both interfaces until you get it working.
Steve
