Bridged LAN interfaces and WebConfigurator

[rob51i03]

I have a device with multiple NICs. I've configured one as WAN, another as LAN and the others are currently inactive.

em0 -> WAN
em1 -> LAN 172.17.1.1/24 (webConfigurator available on http://172.17.1.1)
em2 - inactive
em3 - inactive

It would be useful to have all the non-WAN NICs bridged and sharing the LAN subnet, so I followed the article here to set up a bridge and a port group and assign all my non-WAN NICs to it.

My intended result is something like this:

em0 -> WAN
em1 -> |
em2 -> |  br0 LAN 172.17.1.1/24 (with webConfigurator available on http://172.17.1.1)
em3 -> |

All is peachy until I attempt to remove the LAN IP from em1 and assign it to br0. I can't do that via the webConfigurator while connected to em1 as it breaks my connection with the webConfigurator. Using a different subnet on br0 is a possibility, but I can't see how to tell pfSense this is now the subnet that the webConfigurator can be reached on, so that I can reconnect and remove the static IP on em1.

Using the console doesn't give me the ability (AFAIK) to assign the LAN to the bridge; only NICS are offered in the option to assign the LAN subnet.

How should I proceed from here?

Thanks

[johnpoz]

Why would you not just make the bro interface .2?

Or do whatever it is you want to do from console?

It would be useful to have all the non-WAN NICs bridged and sharing the LAN subnet

Not really... If you need more interfaces in your lan network - get a bigger or another switch ;)

[Derelict]

I would not move the LAN IP from the interface to the bridge. I would just reassign LAN to bridge0 in Interfaces > Assignments.

Actually, I would not bridge at all. I'd just get a switch.

Since you're bridging I'm sure you're familiar with the pfil sysctls and what they mean to you and your rules.

[rob51i03]

Budget constraints rule out the bigger switch suggestion.

When you suggest doing what I want from the console, what specifically would you recommend? Assign Interfaces doesn't give me an option to assign the LAN to the interface group. It only offers the individual NICs.

Thanks

[Derelict]

Wow. A switch is $10 and will easily outperform this.

There are countless ways to lock yourself out of any layer 2 device when you are attempting to reconfigure the port you are connected on.

You could do this:

1. remove em3 from the bridge
2. throw a temporary numbering scheme on it and a pass any firewall rule.
3. Connect your management workstation to em3 and access the webgui
4. Configure the bridge using em1 and em2. Get it all working
5. Delete the em3 pfSense interface
6. Add em3 as a bridge member

[johnpoz]

Then get another switch... A 8 port gig switch that does vlans is in the 30$ range NEW...

[rob51i03]

@johnpoz
@Derelict

Thank you both very much for sharing the benefit of your experience in this area. I have no desire to force square pegs into round holes. This seems such a case.

I'll re-purpose an existing switch in my environment or buy a cheap unmanaged one, as you suggest, and leave the unused ports on my pfSense box well alone.

Also, I have learned something from @Derelict's last suggestion - I had not grasped before that the webConfigurator will respond on any LAN subnet that has a pass any firewall rule configured; I thought you had to bind it to one. Makes sense now I think about it...

[johnpoz]

I would not waste money on dumb switch.. What you talking a couple of bucks difference? Dumb switch can work if you need to add ports to a specific vlan... But your not going to be doing your future self any favors.. You never know when you might want to put a port on a different vlan if you just use smart switches you can put any vlan on any port..

https://www.amazon.com/D-Link-EasySmart-Gigabit-Ethernet-DGS-1100-08/dp/B008ABLU2I/ref=sr_1_2?s=electronics&ie=UTF8&qid=1541606386&sr=1-2&keywords=dgs-1100-08
$35

https://www.amazon.com/D-Link-Gigabit-Unmanaged-Desktop-DGS-108/dp/B000BCC0LO/ref=sr_1_5?s=electronics&ie=UTF8&qid=1541606450&sr=1-5&keywords=dlink+switch
$30

Your going to kick yourself about that $5 if you need a vlan on that switch ;)