Issues with firewalling & bridging
-
@maverickws said in Issues with firewalling & bridging:
so I created a bridge (bridge0) with the interface where the /28 is as member.
Huh? Why would you think you need a bridge with 1 interface?
-
@johnpoz I got the idea it was required in order to have the firewall inspecting the traffic (transparent firewall).
Saying this because before I had the same config on the interface directly, without any bridge, and pfSense was not firewalling anything.
So, let me try this again in a simpler manner....
I have a dedicated interface with a /28 subnet.
I want clients to get an IP from that /28 and have traffic being filtered by pfSense.What's the approach? Thank you.
-
@maverickws What are you bridging it with??
Why not just setup a dhcp server on OPT1? -
@jarhead that's a great question. I had done that already, and the pfSense wasn't filtering any traffic.
I found this at the docs:
Internal/External Bridges An Internal/External type bridge, also known as a “transparent firewall”, is used to insert a firewall between two segments without altering the other devices. => Most commonly this is used to bridge a WAN to an internal network so that the WAN subnet may be used “inside” the firewall <=, or internally between local segments as an in-line filter. Another common use is for devices behind the firewall to obtain IP addresses via DHCP from an upstream server on the WAN. In a transparent firewall configuration the firewall does not receive the traffic directly or act as a gateway, it merely inspects the traffic as it passes through the firewall. Note - Devices on the internal side of this bridge must continue to use the upstream gateway as their own gateway. Do not set any IP address on the firewall as a gateway for devices on a transparent bridge. NAT is not possible with this style of bridge because NAT requires the traffic to be addressed to the firewall’s MAC address directly in order to take effect. Since the firewall is not the gateway, this does not happen. As such, rules to capture traffic such as those used by a transparent proxy do not function.From: https://docs.netgate.com/pfsense/en/latest/bridges/index.html
Hence adding the bridge.
I tried to highlight this part: "Most commonly this is used to bridge a WAN to an internal network so that the WAN subnet may be used “inside” the firewall"
Which is what I was looking to achieve, and putting the DHCP directly on OPT1 did not filter any traffic.
-
@maverickws So you don't want a DMZ, you want your WAN subnet extended to OPT1?
-
redacted by author
-
@maverickws Good Luck!
-
@jarhead :)
-
@maverickws so your goal is to just route this public IP /28?
To "bridge" you would need at least 2 interfaces.. And the networks would have to be the same on both sides of the bridge.
-
@johnpoz thank you for your reply.
Ok, so, my goal is to "route" the subnet? Doesn't feel like it:
- Already have a WAN connection on its own interface;
- the IP subnet is delivered on an independent interface and is not routed through the WAN IP;
I had already read that article you provided, but it seems to me that article assumes the second subnet (192.0.2.128/29 in the provided example) is routed through WAN. But that is not the case here.
I have a cable from a switch and the /28 is delivered through that connection. My upstream gateway IS one of the IP's on that subnet.
-
@maverickws said in Issues with firewalling & bridging:
My upstream gateway IS one of the IP's on that subnet.
The you would create a bridge sure, this is a transparent firewall. The bridge would have to contain both the interface that pfsense uses to talk upstream to this /28, and the interface on pfsense where your downstream devices connected that are also in this /28
-
Ok so ... that's making sense... you mean
I must add a new interface let's say OPT2 ... the public subnet is delivered at OPT1 ... I bridge the OPT2 and OPT1 into bridge0, and connect the OPT2 to the clients. Cause if they're all connected to the switch/L2 of OPT1 it will go directly out ... right. That's it right? Cheers!
-
@maverickws exactly... you end up with this
/28 network --- opt1 pfsense opt2 -- devices in /28
Where you have bridged opt1 and opt2, you can then filter on this bridge to only allow specific ports, etc.
-
@johnpoz Just one last question ... The IP configuration should be performed on the OPT2 interface or the bridge? I was assuming the bridge but our first test with this config all traffic was being blocked including the traffic from the firewall itself. I did add a rule DMZ net to any allow, but no luck.
-
@maverickws there is no need to set any IP on pfsense on the bridge. I would just be transparent bridge. Only reason you would set an IP on pfsense on the bridge, is you were going need to access it for something.
As just a transparent firewall there really wouldn't be a reason to.. if you wanted to say put .2 out of the /28 on pfsense so you could route some downstream clients to other pfsense networks - ok. Then your devices on the downstream of the /28 bridge could have a route to use this IP to get to other networks via pfsense. But you you stated the gateway would be upstream on the /28
But if you just want to firewall on the bridge, pfsense doesn't need an IP on the bridge. In transparent mode pfsense really has nothing to do with the traffic, its not natting, its not routing - it just inspects the traffic if allowed or not..
But you would create firewall rules on the "bridge" interface..
-
@johnpoz Ok thank you for the feedback.
So what happens here is ... I'm looking to have DHCP enabled with this subnet. So only clients allowed on the DHCP server get IP, and I create a static assignment for each host that will have access.
In order to configure the DHCP server I must have an interface with an IP. So what I have now is:/28 subnet ISP side <-> OPT1 pfsense bridge0 OPT2 <-> /28 inside
I have OPT1 and OPT2 with IP config set to none, and bridge0 with the IP config & DHCP enabled. Am I looking at this wrong?
EDIT: for the life of me I can't get connectivity with this configuration on the OPT2 vm's ...
I've added firewall rules to all interfaces involved ... bridge and members ... allow traffic any to any ...
I've moved the IP configuration from the bridge to the OPT2 member ... nothing. -
@maverickws no that would be correct.
So I would set an IP first on the device in the /28 on your lan side of pfsense. Can you ping the /28 gateway this is upstream?
If I find some time after real work, I have a 3100 laying about here, that I have been meaning to upgrade anyway to 22.01, was going to just wait til 22.05 came out. But I could then lab exactly what your doing..
Might take me a bit.. Still got a couple of hours of work, etc. Wife isn't here - so don't have anything else to do ;) other than continue binging the flash hehehe
-
@johnpoz Ok so I've been hours around this...
So, resuming ...
bridge0=opt1+opt2
opt1 is external
opt2 is internal
tests doing Diagnostics > Ping - destination1.0.0.1objective: transparent firewall
I tried 3 scenarios:
configured IP on the
opt1interfacecould reach target from the
opt2interface only.
so with the IP config on the external member, I could reach outside from the inside member. selecting bridge as the source interface also failed.
...configured IP on the
opt2interfacethe same as before except now the IP config was in the internal interface.
can reach test target fromopt1- the external interface no ip config,
not from the bridge interface or theopt2where the IP config was this time.
...configured IP on the
bridge0interfacecan reach test target from
opt1andopt2interfaces but not from bridge.
I'm thinking sure, my machines are inopt2internal and the outside isopt1so let's go. (never mind this was the first config anyway)clients on
opt2get ip's from dhcp ... mtu value ... provided by pfsense
ip route showshows the default gateway as the correct gateway for the subnet ...pinging from client returns:
From 192.0.20.1 icmp_seq=... Destination Host Unreachable
From 192.0.20.1 icmp_seq=... Destination Host Unreachable
From 192.0.20.1 icmp_seq=... Destination Host UnreachableTesting from client to bridge IP address on the pfsense interface: success
Firewall logs ... nothing. I am unable to find anything useful on the firewall logs. got an email server unreachable bc of this >:( driving me nuts.
edit ... never mind, I think in the meanwhile I lost the ability to ping the firewall from the client. I'm clueless.
-
Hello @maverickws,
Sharing my experience configuring BRIDGE on the last release.
2-6-0-release bridge interface transparent-firewall issue
I cannot simulate this issue in the previous version. -
@mytsuu hi there,
Well looking at your post does look at least a bit similar. You're also bridging two interfaces an internal and an external and trying to pass traffic through it.
I have to say that in my example
opt1 (external)---¡ | | bridge0 | opt2 (internal)---!putting the config on the internal (opt2) interface didn't sound that bad either.
I would (in my mind) take aopt2 network to anyrule on the firewall at the opt2 interface, and rules for incoming traffic put atopt1...My problem is, I did test that already and also failed miserably.
I've been killing my head trying to figure out why this isn't working. In the end feels like should be a simple task. Like let's say your ISP router that allows bridge, you enable the bridge and voila get connectivity directly to the outside when you connect to the bridged port. I've been wondering "should the bridge0 interface be unassigned?" that doesn't feel right to if an interface isn't assigned and enable how could it work?
The truth is, I mean, the strong suit of pfSense is being a firewall ... so how is it so hard and user unfriendly to configure it as a firewall without routing?
