Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Beginner questions regarding transparent firewall

    Firewalling
    3
    7
    3842
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      eduke last edited by

      Topology of my network looked like this:

      inet <–-> router <---> switch <---> lan

      Now I would like to add firewall. The topology would change to something like this:

      inet <---> router <---> pfsense <---> switch <---> lan

      In order not to change anything in LAN setup on host machines I'm going to use transparent firewall. pfsense has 4 NICs. WAN, LAN, OPT1 and OPT2.

      I would like to make transparent firewall on those OPT NICs. Do I have to set on both OPT interfaces to bridge with one another?

      OPT1                          OPT2
      enable                        enable
      type: static                  type: static
      bridge with: OPT2          bridge with: none

      versus

      OPT1                          OPT2
      enable                        enable
      type: static                  type: static
      bridge with: OPT2          bridge with: OPT1

      Is there big difference between these two settings?

      More questions to come :-)

      1 Reply Last reply Reply Quote 0
      • H
        hoba last edited by

        leave one interface static and bridge the other one to it:

        opt1 static
        opt2 bridge to opt1

        I think the other setting won't work at all. Don't forget to set "filtering bridge" at system>advanced in the webgui and create appropriate rules.

        1 Reply Last reply Reply Quote 0
        • E
          eduke last edited by

          OK but in that case I have to put IP address on one interface and that is what I don't want to do, because hosts have GW set up to IP on router interface. I tried it with bridge set up on both OPT and it works. With this configuration all traffic just flows through the pfsense box as it wouldn't be there (because of the rules set to pass everything)

          1 Reply Last reply Reply Quote 0
          • H
            hoba last edited by

            Why do you ask something when you already set up something and tested it then?  :P

            1 Reply Last reply Reply Quote 0
            • Gertjan
              Gertjan last edited by

              @eduke:

              Topology of my network looked like this:
              inet <–-> router <---> switch <---> lan

              Ok, a real basic - often used - setup.

              Now I would like to add firewall. The topology would change to something like this:
              inet <–-> router <---> pfsense <---> switch <---> lan

              I can assure you that this works when you setup pFsense from the box.
              Configure WAN access (ISP) stuff - give it a static LAN IP (your 'new' gateway) - and up you are.

              In order not to change anything in LAN setup on host machines I'm going to use transparent firewall. pfsense has 4 NICs. WAN, LAN, OPT1 and OPT2.

              Things DO change here : are you using the pFsense box as a simple switch between LAN-OPT1-OPT2 ? Why not using a real 'simple' switch ? They are real good at switching  ;)

              But you should be able to do so - bridge them all together. Give the LAN an IP (this will be the gateway) - and bridge OPT1-OPT2 to it. (So no IP's need here). I never did so, but I tend to say that a firewall rule like 'all to all = ok' on all interfaces (only OPT-OPT2 ?) is needed.

              And why still using the initial router (or is it a modem also ?) ? Send it on holiday (remove the routing activity) - this makes your setup simpler to administrer. pFsense handles the routing very well (at least at the last time I checked  ;D).

              No "help me" PM's please. Use the forum.

              1 Reply Last reply Reply Quote 0
              • E
                eduke last edited by

                @hoba:

                Why do you ask something when you already set up something and tested it then?  :P

                I tried it after I had asked and you had replyed. And then I posted message that it is working so anyone will know that it is possible.

                1 Reply Last reply Reply Quote 0
                • E
                  eduke last edited by

                  @Gertjan:

                  And why still using the initial router (or is it a modem also ?) ? Send it on holiday (remove the routing activity) - this makes your setup simpler to administrer. pFsense handles the routing very well (at least at the last time I checked  ;D).

                  I can't remove the router becaus it does more things then I showed here. I want to use pfSense just as firewall. I don't need its router and other features.

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post