Unable to access Transparent Bridge (WAN/LAN) from LAN

swears123

I'm looking to offload the firewall/security to the pfsense as the Unifi Dream Router has a very weak CPU and can't seem to handle high throughput with IDS/IPS enabled.

The Unifi uses DHCP on the WAN side to pull the IP (but only shows the external IP, not cable modem IP)

swears123

@viragomann I added a static route in pfsense to point to 10.50.10.0/24. Is this what you recommended?

viragomann

@swears123
You need to add the UDM IP (this one in 192.168.100.0/24) as gateway first, then add the route for the 10.50.10.0/24 network and point to the UDM gateway.

DefenderLLC

So I am having a very similar issue trying to change my 6100 MAX to become a transparent firewall between my AT&T Fiber Gateway and my UDM-SE. This forum post is very close to what I’m trying to do, but it doesn’t seem to work for me nor did the OP respond if he/she ever got it working. I’ve also watched Tom Lawrence’s YouTube videos on this, but in his example he’s not including his WAN interface - only two LAN interfaces.

Note that I have been using my 6100 MAX in front of my UDM-SE in a dual-NAT scenario primarily for much better control over DNS filtering (pfBlocker) and Snort (IPS: WAN, IDS: LAN). This has worked flawlessly for almost a year with no issues (although doing port forwards can be kind of tricky), and no problems up to this point. For the sake of masking my real public IPs, please just assume that 99.99.99.99/29 is my public IP block (AT&T actually provides a /32 and a /29 for a total of 6 usable public IPs).

—————————————————————————

Current Deployment and Configuration

[Internet] ----- [AT&T Gateway] ----- [pfSense] ----- [UDM-SE]

AT&T Gateway (99.99.99.99/29) WAN "IP passover" mode to pfSense (essentially just a modem and gateway)
AT&T Gateway (192.168.0.1/24) - LAN
pfSense (99.99.99.99/29) - WAN (via DHCP for primary /32 WAN IP plus additional /29 block configured as virtual IPs)
pfSense (10.0.0.1/24) - LAN
UDM-SE (10.0.0.2) - WAN IP via DHCP from pfSense
UDM-SE (10.0.1.1) - MGMT IP

Again, no problems whatsoever up to this point. I can get to all 3 management interfaces (AT&T/pfSense/UDM-SE) from my UniFi LAN without issue.

—————————————————————————

What I want to do is change my 6100 MAX to become a transparent firewall instead so I can get rid of dual-NAT scenario and manage my 6 public IPs on the UDM-SE instead.

Within pfSense, I have tried disabling NAT, creating a new bridge with both LAN/WAN (this also includes changing both System Tunables to member=0 and bridge=1 and setting the LAN and WAN interfaces to no IP address) and assigned it a management IP on the AT&T Gateway LAN. No dice getting to pfSense or AT&T gateway's web interfaces. No Internet connectivity at all. If I set both System Tunables to 0, everything works (minus any filtering of course). Once I turn the bridge tunable back to 1, I keep seeing default denies in the firewall log. I don't understand why because I temporarily have all interfaces firewall rules wide open for IPv4.
 
Proposed Deployment and Configuration:

[Internet] ----- [AT&T Gateway] ----- [pfSense] ----- [UDM-SE]

AT&T Gateway (99.99.99.99/29) WAN "IP passover" mode to UDM-SE (essentially just a modem and gateway)
AT&T Gateway (192.168.0.1/24) - LAN
pfSense with LAN/WAN configured as a bridge interface
UDM-SE WAN: (static /32 plus 99.99.99.99/29 as additional IPs)
UDM-SE LAN (10.0.1.1) - MGMT IP

I have scoured through so many forum posts and other websites for about 2 days trying to get this to work, but I keep having to revert back to my current setup (thank goodness for pfSense Plus boot environments). I should not have to configure any static routes since a transparent firewall should work without changing anything on the AT&T Gateway or UDM-SE. The proposed scenario obviously works perfectly fine without the pfSense in the mix. So what is the proper way to do this? No matter what I try, I can’t seem to get this to work. Thanks.