Filtering Bridge locks out everything

Guest

i hope im right here and i hope i am not repeating a thousand other questions…

but ive got a problem on my wrap board with 3 nics. im in a 10.0.0.0/8 network and i'd like to exchange my old obsd bridge with a pfsense fw.

but for me it is not possible to get traffic over the filtering bridge. ive bridged LAN with WAN (both interface have ips in the same segment of course) but the moment when i activate filtering bridge all traffic stops. and lokking at the logs it seems that the firewall rules wont let any packets through.

ive made 2 dummy rules on the interfaces. (excerpt from the debug log)

User-defined rules follow

pass in quick on $wan from any to any keep state label "USER_RULE: test"
pass in quick on $lan from any to any keep state label "USER_RULE: test"

(fyi
loopback = "{ lo0 }"
lan = "{ sis0 bridge0 }"
wan = "{ sis1 bridge0 }")

anyone got any suggestions?

btw. yes ive read the tutorial

hoba

What version? Also make sure you don't have an ethernet loop. STP is enabled by default on bridges which will cause a block if there is a loop. status>interfaces will have a note about this if this is the case.

Guest

ive got
Version 1.0.1
built on Sun Oct 29 01:45:08 UTC 2006

there is no loop the interfaces are definitely on two "different networks"
just to be sure:
Status up
MAC address 00:0d:b9:03:5d:89
IP address 10.22.2.214
Subnet mask 255.0.0.0
Gateway 10.0.0.1
ISP DNS servers 10.0.0.11
10.0.0.2
Media 10baseT/UTP
In/out packets 24355623/25519222 (1.75 GB/2.68 GB)
In/out errors 48/13
Collisions 5449498
Bridge (bridge0) learning

LAN interface (sis0)
Status up
MAC address 00:0d:b9:03:5d:88
IP address 10.2.2.214
Subnet mask 255.0.0.0
Media 100baseTX <full-duplex>In/out packets 25094783/24201341 (2.66 GB/1.49 GB)
In/out errors 0/0
Collisions 0
Bridge (bridge0) learning</full-duplex>

jeroen234

In/out errors 48/13
Collisions 5449498

there is a big problem on youre network

Guest

thats ok because an the wan side there is a BNC - Coax network - a hub between coax and pfsense does the medium conversion

jeroen234

well 20% of youre traffic is ending up on the hospital and has to be send again

Guest

yupp i know - about 50 ppl on a segmented switched coax lan - but thats not the problem… bridging as such is working fine. but when you activete the filtering bridge - no more traffic ;)

hilove

i have absultly the same problem with filtering bridge .. when i open the filtering bridge option in system->advanced all traffic will block no matter what rules i set in firewall

Guest

are there any news to this topic?

there must be more ppl with this problem if it really is a problem…
if i compare it with the ruleset of my obsd in the pf.conf i miss all the outgoing rules. (pass in - pass out)but actually i am not THE firewall - knowingitall kind a guy.

but seriously
any news would be great!

Tinozaure

I have been blocked exactly the same way using the bridging tutorial.
try setting the LAN ip with something completely outside your networks.
It worked for me

Guest

Weehaaaa thats it!

That must be definitely a bug!

when activating the filtering bridge the other address must be completely in another range. then it works like a charm!

thanx Tinozaure

sullrich

It is not a bug, it is how FreeBSD works.