Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [Q] pfSense on Hyper-V 2012R2 - transparent mode - possible? {YES}

    Scheduled Pinned Locked Moved General pfSense Questions
    22 Posts 5 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mdalacu
      last edited by mdalacu

      Hi, i have tried to get this to work without success. So, i ask:
      Is it possible to run pfSense firewall on Hyper-V 2012R2 in transparent mode?
      Thank you!

      EDIT: YEST, it is possible and it is working after i enapbled MAC Spoofing on both virtual NICs.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        So setup as a transparent firewall? WAN and LAN bridged?

        I see no reason why not. What have you tried? How did it fail?

        Steve

        1 Reply Last reply Reply Quote 0
        • M
          mdalacu
          last edited by

          Yes both bridged and the bridge gets the management ip..
          I can not get the traffic to pass either way.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Well how do you have it all connected from your physical network to your VM pfsense?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • kiokomanK
              kiokoman LAYER 8
              last edited by kiokoman

              disable outbound nat
              Tunable
              net.link.bridge.pfil_bridge and set the value to 1
              net.link.bridge.pfil_member to a value of 0
              net.link.bridge.pfil_onlyip 0

              “Interfaces / WAN” disable/uncheck “Block private networks and loopback addresses” and “Block bogon networks“
              the IPv4 and IPv6 configuration type must be set to None for WAN and LAN
              Under Firewall / Rules select the WAN interface and create a rule that passes all traffic over the interface

              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
              Please do not use chat/PM to ask for help
              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

              M 1 Reply Last reply Reply Quote 0
              • M
                mdalacu @kiokoman
                last edited by

                @kiokoman said in [Q] pfSense on Hyper-V 2012R2 - transparent mode - possible?:

                All o f that i have done...no avial. I am pulling my hair out...and i don't have much :/
                All virtual interfaces are connected to phisical NIC.
                If i put another hdd in the VM with Untangle...it works just fine in transparent mode...
                Please, any more ideas?
                Thanks alot

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  @mdalacu said in [Q] pfSense on Hyper-V 2012R2 - transparent mode - possible?:

                  All virtual interfaces are connected to phisical NIC.

                  And how and the F would that work? You mean multiple physical nics? With different L2 networks? You mean physical nic with different vlans on it.

                  Draw up how you have your network connected... And how this is tied to your VM network..

                  Untangle use ARP poisoning, which is just UTTER CRAP way to do anything... And that is not a bridge that is just poisoning the network so devices think untangle is the IP of the gateway..

                  Nobody can help you if you don't give details of how your setup..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • provelsP
                    provels
                    last edited by

                    Anything here that might help?
                    https://content.spiceworksstatic.com/service.community/p/post_attachments/0000161351/5355bf8a/attached_file/Transparent_Firewall-Filtering_Bridge_-_pfSense_2.0.2_By_William_Tarrh.pdf
                    Like this?

                    13. Overview and Understanding of the Transparent Bridge
                    I use the WAN as the management interface because I was unable to reach anything
                    external, obtain updates or browse packages when the LAN or Bridge was configured as the
                    management interface. 
                    

                    Peder

                    MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                    BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                    M 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      This you can bridge
                      bridge.png

                      This can not
                      nobridge.png

                      Are you trying to bridge 2 physical separate L2 networks, or are you 2 different layer 2 networks you wanting to bridge isolated via vlans on a switch, etc.

                      edit: Bridging is almost always the WRONG choice.. And should only be done if you can not do it any other way.. Why can you not just route? What exactly are you trying to accomplish via this bridge? Do you need to firewall devices from each other that have to reside in the same L2 for some reason only known to you?

                      Bridging is a solution when you have to combine L2 vs multiple types of interfaces.. Say wifi to wired, or fiber to ethernet.. And your bridging devices has the multiple interfaces, etc.

                      Or you want to do some sort of transparent firewall and can not alter the network in any other way, etc. etc..

                      Again bridging is almost always going to be the wrong choice..

                      What is the end goal here?? And we can discuss how to best accomplish that goal.

                      For example if your wanting wireless to be on the same L2 as your wired devices, vs using an interface on pfsense to connect or be your wifi you would use an AP and just connect it into the wired network of your switching infrastructure.

                      If your router has fiber interface and your switching infrastructure does not, and you want L2 connected via fiber to be on the same ethernet L2, it prob better to just get a media converter for like $50 bucks tops and connect that into your switching infrastructure. Or just get a fiber sfp or sfp+ to connect to your switch.

                      edit: The only time I would look to bridging on pfsense would be, all the computer stores are closed, or amazon can only get me the proper equipment in 2 days and I need it up NOW for production purposes.. ;)

                      If you think bridging is the solution to whatever your end goal is here, your more than likely looking at the problem from the wrong direction.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        mdalacu @johnpoz
                        last edited by mdalacu

                        @johnpoz Hi! i manage it for a small firm..40 stations..remote ;) All are connected behind a small router in an unmanaged switch. From this i have to move...
                        The problem is that the management hired an security audit and concluded that the LAN is not considered safe anymore (someone could physically plug an rouge device and listen to passwords )...and i must implement a lost of things in order to separate servers form lan and also implement 802.1x. I have studied a little bit and conlcuded that pfSense is the winner in my situation. So, i have bought a managed switch and i will migrate one client at a time. Between the servers and the clients will be pfSense in transparent mode so i don't have to change a lot of things. All the servers and pfSense are residing on the same host. I use multiple NICs to achive this.
                        Short verion: I need pfSense in transparent FW mode with FreeRadius and a transparent proxy so i can filter web connections...in a virtual machine...
                        Do you think i am able to achive this? Thanks.

                        Edit: I have the transparent FW part working. I had to enable in HyperV MAC Spoofing on each interface.
                        The transparent proxy is another thing...i can not do it. I need to get reports for web traffic and to be able to block some URL. I try to do it first on 80 then i will move to ssl inspection
                        As soon as i enable transparent proxy i can not reach anything on port 80...and yes, i have changed the web managemnet port. Squit and transparent both are listening on OPT1 brige. Do i have to enable somenting in tunabale or another firewall rule?

                        I know it is phisically posible since Untagle is doing this by default.
                        Thanks agan

                        1 Reply Last reply Reply Quote 0
                        • M
                          mdalacu @provels
                          last edited by

                          @provels Yes this is the first thing that i ran into...then the phisical nics and then ...MAC Spoofing.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            @mdalacu said in [Q] pfSense on Hyper-V 2012R2 - transparent mode - possible?:

                            I need pfSense in transparent FW mode with FreeRadius and a transparent proxy so i can filter web connections

                            Why would you think this, that is not the case at all.. There is a huge difference between running a transparent firewall and and a transparent proxy. Neither are normally a good choice.. And should only be done when there is no other way..

                            You have not given any reason why this could not just be routed with a explicit proxy. And sure you could do transparent proxy as well.. But to be honest would block vs allowing transparent.. And only do transparent for something that can not use a proxy.. Some stupid iot device or something that does not officially support proxy. And such devices should be on their own vlan anyway.,

                            Why can you not just use pfsense as normal L3 firewall router, and run proxy on this... Why do you think you need it to be transparent?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            M 1 Reply Last reply Reply Quote 0
                            • M
                              mdalacu @johnpoz
                              last edited by mdalacu

                              @johnpoz Because if all falls apart i just a cable away (putting it between SWitches or do some briging on the host)...and do it remotly...
                              And i am just one guy doing all this beside my office hours :-))

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                So your trying to set this all up remote? hehe dude you should be on site for such setup..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                M 1 Reply Last reply Reply Quote 0
                                • M
                                  mdalacu @johnpoz
                                  last edited by

                                  @johnpoz After i setup this on premises i will manage all remote like i have done for several years. But i need in case of FW failure to let people work with minimal disturbance and not wait for me to get there.
                                  I really hope that i will be able to do the transparent proxy....right now i am stuck...

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    You can't use Squid in transparent mode on a bridged firewall. The redirect rules do not function on bridged interfaces.
                                    Or at least they did not last time I tested this:
                                    https://redmine.pfsense.org/issues/1620

                                    You might also consider that the usefulness of a transparent proxy is limited anyway. Once encrypted SNI becomes widespread you will no longer be able to see or filter https traffic without full ssl intercept.
                                    https://blog.cloudflare.com/encrypted-sni/

                                    Steve

                                    M 1 Reply Last reply Reply Quote 1
                                    • M
                                      mdalacu @stephenw10
                                      last edited by

                                      @stephenw10 Thanks for answering!
                                      I just wanted to make it work like untangle in transparent mode.
                                      I will see what i can do....
                                      The Freeradius part it is working...i hope squid will do to....but transparent....

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Not if it's redirecting on a bridged interface. You can try the patch linked in that bug report. It's been a while since I tested it but I was never able to make it work despite trying every combination of things I could think of. Something may have changed since then.

                                        Steve

                                        M 1 Reply Last reply Reply Quote 0
                                        • M
                                          mdalacu @stephenw10
                                          last edited by

                                          @stephenw10 Yes, you are right...not working. I have tried everything that i can think off. I was hoping that fixing the problem i was having with Freeradius will also fix this, but no ( i had to manually add the name of the server in DNS overwrites) The patch seems to be merged since 2017...
                                          What else could i try for transparent proxy to work on bridged interface?
                                          Thanks.

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            You could try a 2.5 snapshot. They are built on FreeBSD 12. Since this appears to be an upstream limitation in pf that may have been fixed.

                                            Steve

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.