Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Bridge setup

    Firewalling
    2
    6
    2075
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cubsfan last edited by

      Which interface should I setup rules on in a bridged setup?  If I enable the filtering bridge option, do I need to setup rules on both interfaces?

      I guess more generally also, what are the pros and cons of the filtering bridge option?

      1 Reply Last reply Reply Quote 0
      • H
        hoba last edited by

        You always filter incoming traffic at an interface, so yes, you want rules on both interfaces depending from where the traffic comes that you want to filter.

        1 Reply Last reply Reply Quote 0
        • C
          cubsfan last edited by

          So say in my DMZ I have a web server.  Do I have to duplicate the rules from my WAN interface to OPT1 to allow access to that web server?

          1 Reply Last reply Reply Quote 0
          • H
            hoba last edited by

            I hope this clears it up a bit:
            Rules on WAN determin what traffic will reach your webserver.
            Rules on OPT1 determines where your webserver is allowed to go to.

            E.g. if you want your webserver to not be able to go anywhere but want clients coming from WAN be able to reach it at port 80 you only need one rule at WAN for this.

            1 Reply Last reply Reply Quote 0
            • C
              cubsfan last edited by

              @hoba:

              I hope this clears it up a bit:
              Rules on WAN determin what traffic will reach your webserver.
              Rules on OPT1 determines where your webserver is allowed to go to.

              E.g. if you want your webserver to not be able to go anywhere but want clients coming from WAN be able to reach it at port 80 you only need one rule at WAN for this.

              Getting clearer I think :)

              So if I disable the filtering bridge then hosts on OPT1 are completely unrestricted?

              With Cisco I can apply an ACL to an interface explicitely either as an inbound or outbound ACL.  Is inbound vs outbound filtering in pf implied by what interface you are connected to?

              1 Reply Last reply Reply Quote 0
              • H
                hoba last edited by

                It's just by design that we only filter incoming. There have been lots of discussions about changing that. Search the mailinglists for this discussions. If you are only interested in the result of the discussion: We (pfSense devteam) don't want to change that.

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post

                Products

                • Platform Overview
                • TNSR
                • pfSense
                • Appliances

                Services

                • Training
                • Professional Services

                Support

                • Subscription Plans
                • Contact Support
                • Product Lifecycle
                • Documentation

                News

                • Media Coverage
                • Press
                • Events

                Resources

                • Blog
                • FAQ
                • Find a Partner
                • Resource Library
                • Security Information

                Company

                • About Us
                • Careers
                • Partners
                • Contact Us
                • Legal
                Our Mission

                We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                Subscribe to our Newsletter

                Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                © 2021 Rubicon Communications, LLC | Privacy Policy