No filtering when using bridge

graham1871 · Dec 3, 2019, 6:51 PM

Hi,
I have a pfSense installation which is using one physical network interface, and I have configured a bridge for WAN and LAN in order to have a transparent firewall. I have done this so that all the servers on the network can have the same public gateway and public IP addresses (no NAT). I have disabled NAT.

I have followed this guidance as I want the bridge to do the filtering:
net.link.bridge.pfil_member and net.link.bridge.pfil_bridge under System > Advanced on the System Tunables tab. With them set at 0 and 1, respectively, then filtering would be performed on the bridge only.

The WAN and LAN have no IP addresses.

I have added an OPT1 interface that is the bridge and it has the IP address and gateway on it.

The issue I have is that there is no filtering taking place. Everything is allowed from everywhere to the servers despite no rules being in place to allow the traffic.

If I check the logs there are no details on anything apart from access to the firewall's IP (which is being blocked as expected and only allowed from the IPs I have added).

Derelict · Dec 4, 2019, 1:04 AM

What did you bridge with one physical interface?

graham1871 · Dec 4, 2019, 10:54 AM

Sorry - that's a mistake on my first message, I should have put one public subnet. The bridge is the WAN to LAN. I have configured it so that neither has an IP address and the IP address is instead on the bridge (OPT1). The firewall and all the machines behind it have public IP addresses and all use a public gateway.

Derelict · Dec 4, 2019, 7:19 PM

net.link.bridge.pfil_member=0 and net.link.bridge.pfil_bridge=1

Right. In that configuration you want to filter on the members, not the bridge interface. There is no filtering between the members there, only into the bridge interface. If something is going from one bridge member on the WAN to a bridge member on the LAN, the traffic never passes into the bridge interface itself.

So if you want to filter on the WAN to members on the bridged LAN, you should be filtering on the WAN member.

The filters on the bridge itself will apply to traffic to the bridge's address(es).

graham1871 · Dec 5, 2019, 4:36 PM

Thank you for your help.

It does seem to be up and running now!
Thanks.