Help for Firewall and bridge

really2002

I have a box with pfsense 2.45-1 , and I set 1 interface for wan with the static IP(192.168.0.2) to connect the upper router, and set four LAN interfaces as a switch using the bridge function(192.168.2.248). and I set DHCP on the bridge(192.168.2.0/24), and in the DHCP,I set the DNS and gateway to my OpenWRT box's IP(192.168.2.247).

I have add all pass rule on each interface and bridge, I am confused with net.link.bridge.pfil_bridge and net.link.bridge.pfil_member, as the document says:
net.link.bridge.pfil_bridge filtering on the bridge interface
net.link.bridge.pfil_member filtering on the incoming and outgoing member interfaces

and I set net.link.bridge.pfil_bridge=1 and net.link.bridge.pfil_member=0 because I want to set the rule only on the bridge to control all the Lan interface. BUT the all the wifi terminals can not access the internet , it only shows connected but no internet rights. their gateway and dns is auto get to 192.168.2.247. however the PC connect to the pfsense can access internet and PC, wifi terminals can access each other.

when I set net.link.bridge.pfil_bridge=0 and net.link.bridge.pfil_member=0 , all wifi terminals can connect internet and they are OK. I change nothing only except the net.link.bridge.pfil_bridge=0.

when I set net.link.bridge.pfil_bridge=0 and net.link.bridge.pfil_member=1 , all the wifi terminals can not access the internet.

and I continue to test the bridge and find out when I set net.link.bridge.pfil_bridge=1 and net.link.bridge.pfil_member=0, and I change the DHCP gateway to 192.168.2.248 , the wifi terminals are OK agian .

so what is the exactly function of net.link.bridge.pfil_member and net.link.bridge.pfil_bridge? if I set them both 0, it means all rules will be ignore? but actually, I add the block rule on bridge and it works.

and whats wrong with my wifi terminal when i set net.link.bridge.pfil_bridge=1 ?

bingo600

Depending on what box you have (does it have an internal switch chipset).
Bridging on a NON switch chipset is a Kludge , and NOT best practice.

/Bingo

really2002

@bingo600

I use esxi to install the pfsense, and with 5 ports intel ethernet pcie card

bingo600

My best advice : If you need a switch , buy a switch.
With reference to the above, i have no experience with pfSense and bridging.

But i see a lot of experienced members giving the same advice.

/Bingo