Hello everyone,
First of all thanks for having me at the forum.
I am new to opnsense and building my first device based on an Intel j3455 with 4gb with 2 Intel n211 nic's.
I want to use it in transparant bridge mode, but the model has only two nic's.
Before I put a lot of time into it I want to know, Is this possible to build and still use the web UI in this situation (and have a safe system off course ;))
Thanks everyone!!
Perfectly possible but the devil is in the details. You need to assign an IP address to the bridge interface for management and create appropriate firewall rules.
May I ask why you intend to use a filtering bridge? In my experience in almost all situations routing is far superior to bridging.
Thanks for the reply!
The reason I am bridging is because I am perfectly happy with my EBM68 and mesh nodes, but I want to dive into some more serious firewall concepts.
Besides that I am down with a back injury and I hate being bored 😅
I assume the firewall rules are something like only allowing local IP's accès the UI and applying bogon filtering?
Quote from: Jaapaap on July 01, 2026, 07:23:11 PMI assume the firewall rules are something like only allowing local IP's accès the UI and applying bogon filtering?
Sort of, yes. Unfortunately there is no ready-made recipe for a transparent bridge. Even the official documentation just suggests enabling IDS/IPS. If you want to really filter transparently with default deny (!) you obviously need to take DHCP from/to your uplink router, neighbour discovery in case of IPv6 etc. etc. into account. Even ARP? I don't know. Probably pf on the bridge only deals with IPv4/6. That would mean there is no firewall rule but maybe a global sysctl to pass non-IP traffic like ARP transparently.
Unknown terrain - there be dragons! But you probably won't be bored. 🙂
That's why I prefer routing.
Ok, the rabbit hole is deeper than i thought... :)
I only wanted to use the box for CrowdSec, GeoIP and WireGuard.
So my thoughts where:
igbo - no IP
igb1 - no IP
Bridge - local managemend IP
Sounded quite straight foreward, but the key is securing the bridge (if not sufficiently gaurded by the standerd firewall rules).
But since a Hero Member is warning me about dragons ;) i getting second thoughts. Did I perhaps bite off more than i can chew??
What I always wondered about that transparent bridge setup: If you have only two sides between to filter traffic, then what would be so difficult as to use different subnets (aka routing)? And if you don't, like if you have separate VLANs, then how to you even get the traffic to pass your firewall?
Once you get to understand routing, it seems natural to choose that, which is possibly why < 1% of people here would be able to help if you don't.
There's also good docs for answering the question, https://docs.opnsense.org/manual/how-tos/transparent_bridge.html
Can the device support wifi?
You can use wifi in AP mode, for just mgmt.
https://docs.opnsense.org/manual/how-tos/interface_wireless_internal.html
Quote from: Patrick M. Hausen on July 01, 2026, 07:00:16 PMMay I ask why you intend to use a filtering bridge? In my experience in almost all situations routing is far superior to bridging.
I am curious about this. In many of my PaloAlto setups I use virtual-wire (bridge) which removes L3 and increases performance (no routing time on hardware). Albeit each side of my bridge is a logical router in same subnet where each has their own WAN, so basically wedging a FW between two WANs w/o adding L3.
Is the OPNsense bridge using two (dedicated) NICs different?
Quote from: meyergru on July 01, 2026, 09:27:19 PMWhat I always wondered about that transparent bridge setup: If you have only two sides between to filter traffic, then what would be so difficult as to use different subnets (aka routing)? And if you don't, like if you have separate VLANs, then how to you even get the traffic to pass your firewall?
I dont think we can bridge two different vlans (subnets), has to be the same vlan (subnet). Albeit we can make vlanID-1 and vlandID-2 using hosts that are all in same /24, as example. This means all host IPs are local, the bridge needs to learn MACs and then proxy-arp what it knows about, so that L2 can function normally.
A bridge does not proxy-arp, it simply passes ARP packets transparently. Any switch is a bridge. So two bridged networks are really just one.
Quote from: BrandyWine on July 01, 2026, 09:34:16 PM[...]I dont think we can bridge two different vlans, has to be the same vlan. This means all host IPs are local, the bridge needs to learn MACs and then proxy-arp what it knows about, so that L2 can function normally.
Not sure what you're describing there. FreeBSD bridging seems to be pretty straightforward. ARP is... well, bridged. No proxy, unless you configure one (and FreeBSD default proxy ARP is cheeesy).
To the original poster: Bridging works for me. My Internet link is bridged, and managing several internal networks on the firewall (I have a few more than two interfaces, and everything runs through the firewall) is quite easy with bridges. The only downside I've seen is FreeBSD's susceptibility to ARP proxies (my Internet ONT is one, so I have static ARP entries for everything on that bridge except for the ONT). (A "layer"-agnostic filter would be nice, but hey.) Not much more to it. It may work for you, or not.
Quote from: meyergru on July 01, 2026, 09:27:19 PMWhat I always wondered about that transparent bridge setup: If you have only two sides between to filter traffic, then what would be so difficult as to use different subnets (aka routing)? And if you don't, like if you have separate VLANs, then how to you even get the traffic to pass your firewall?
Like I said I like my EBM68 so it would just be serving for CrowdSec, GeoIP and WireGuard.
I do not use vlan's besides a SDN on my EBM68 for a guest network.
I always that router behind router = hell, so I started out with bridge mode.
@BrandyWine
It does not have wifi, but I do have a usb to Ethernet dongle laying around. Realtek chip though, so I don't no if that is a smart move.
But my main question is, is the bridge safe from the wan side when given an local IP address.
My remarks were not really meant to be questions, but purely rhetorical, which is to say:
If you only have two sides (or interfaces), doing a routed setup is no more complex than a transparent bridge - if you have more than two, a transparent bridge cannot be used at all (or at least I fail to see how). So, why use a transparent bridge in the first place?
Quote from: Jaapaap on July 01, 2026, 10:26:17 PMBut my main question is, is the bridge safe from the wan side when given an local IP address.
If your firewall rules block that access, you are safe. If they don't, you are not. Or then again ... if the router in front of your bridged OPNsense does NAT and firewalling as is the case for the majority of setups how would anyone on the Internet access your OPNsense's private RFC 1918 address?
What do you hope to add? Your router which you seem to like already blocks everything from the Internet inbound to your network.
You might consider setting up a Pihole or AdGuard Home for DNS filtering for outbound blocking. I do not see anything you are gaining with that bridge. Crowdsec is worthless for free tier users (my opinion!).
Can your current router add static routes for internal networks? If yes, you can use router behind router without double NAT and you can run DHCP and DNS for the double private network on OPNsense and then we're in business. Bridging is a measure of last resort if the router cannot be replaced for policy reasons and it does not support static routes and/or you do not have access because it's all ISP managed and you do not trust your ISP.
Quote from: Patrick M. Hausen on July 01, 2026, 09:53:07 PMA bridge does not proxy-arp, it simply passes ARP packets transparently. Any switch is a bridge. So two bridged networks are really just one.
Yeah, bad choice of words I used.
I had done this debate years ago. Since there's a fwd'ing device between the two hosts (a L2 switch), where neither bridge port is ever a host, it's technically doing "proxy" to be able to move across the bridge (it accepts frames on behalf of destination, then fwd's). It's not the L3 proxy-arp, so my bad for that missing clarity.
I believe in OPNsense we can do 2+ ports for a single bridge. This makes it easy to create 4 segments where all hosts are IP'd as /22 but each segment is kept in contiguous /24 blocks, and each is firewalled from the others. LAN/WAN/WIFI/NAS, etc, all using one switch (one vlanID per segment).
So when short on L3 interfaces, use bridge and managed switch to facilitate segmentation, even when everything is in the same L3 subnet.
One minor pitfall with bridge, as host counts go up on each side of the bridge, more wasted cpu cycles come with. Any/all arp broadcasts (who has) get copied to the other side of the bridge (all ports), which means the fw has to process packets even when the two hosts involved are on same side of bridge.
Ok, let's start with how did I get here 😉
I am/was down with a back injury. I got me a cheap mini pc with 2 nic's and was looking to give it purpose.
Since I have got NAS and HASS server running I 'thought' that best use case was setting it up as a firewall.
If the conclusion is that it's overkill/unnecessary I can easily drop the project and perhaps set it up for Adguard or something.
It's pure hobby, but it does have to be functional. So please just tell me to drop the stupid project if that you pros opinions 😆
Extra points of failure with no benefits is not worth the hobby.
@BrandyWine Let's stick with terminology established by Radia Perlman (the lady who invented spanning tree and now presents at conferences stating layer 2 bridging was a big mistake):
- a device making forwarding decisions based on layer 2 addresses is a bridge
- a device making forwarding decisions based on layer 3 addresses is a router
- "switch" is a marketing term that can mean anything but is intended to say "faster/cheaper/somehow-better than our competitors"
Essentially any layer 2 switch is a multiport bridge and nothing else and a layer 3 switch is a router.
@Jaapaap Do you control the router you have and seem to like? Not your ISP? Do you trust it? If the answer to all these is "yes", you won't gain much but an incredible amount of complexity by adding a bridging firewall.
I trust my router (Asus expertwifi business line) and my isp enough.
I don't use port forwarding and got a openvpn connection on the router for when needed.
I am planning on setting up Cloudflare for outdoor home assistant use, so I think I am safe enough for a home user.
Given your reply I guess I had a fun ride exploring opnsense, but I probably use the machine for Adguard (completely new to that to, but it keeps me occupied 😄).
Thanks for the quick course and the adventure in opnsense.
Quote from: Patrick M. Hausen on July 01, 2026, 10:57:25 PM- a device making forwarding decisions based on layer 3 addresses is a router
That's technically not correct, she is incorrect. L3 decision simply decides next-hop IP (talking strictly tcp/ip), not any forwarding. Forwarding always (always) happens at L2, 100% just a MAC-Port thing down to Tx on L1. ;)
ARP sits between L3 and L2. L3 is the IP-MAC table, L2 is the MAC-Port table. There is no frame forwarding on ethernet at L3.
It's a play on words mostly. "Forwarding" is a L1 frame thing. L2 on the receiver is logically processed only after the frame has been forwarded. The IP-MAC and MAC-Port things are just matrix tables stored in device memory.
And to boot - no router is a switch, and no switch is a router, but all routers have a switcher, otherwise the frames could never Tx or Rx.
Radia Perlman is incorrect. OK. I'm out.
Quote from: Patrick M. Hausen on July 01, 2026, 10:59:01 PM@Jaapaap Do you control the router you have and seem to like? Not your ISP? Do you trust it? If the answer to all these is "yes", you won't gain much but an incredible amount of complexity by adding a bridging firewall.
There's also broadcast MAC issue, DHCP. Initial broadcast FFFFFF will pass right through the fw, ISP modem will try and reply, but that reply can be blocked by fw. But then I wonder if the ISP modem logs a lease? Some ISPs only allow x# of WAN leases.
Not sure of the actual setup OP has, could buffer ISP & fw with a router that has no features turned on (except NAT), just a simple dummy L3, WAN for getting dhcp for router, and LAN on router for DFG. Adds a buffer, but make sure the router denies all inbound to it's WAN iface, etc. Then bridge between router and internal subnet(s). Technically not a bad setup, places a little buffer (dmz) between ISP modem and fw.
Quote from: Patrick M. Hausen on July 02, 2026, 12:31:33 AMRadia Perlman is incorrect. OK. I'm out.
I know what she meant, but in technical terms she stated it incorrectly.
If I use the literal definition of forwarding ethernet frames, yes, she is wrong. There is no "forwarding" decisions being done at L3. There's only next-hop decision at L3, which is not "forwarding".
"Forwarding" is literally originates at L1 Tx. This is the only way a frame can move.
Take for example a router with two ifaces, packet comes in on A and routing table says next-hop is an IP on the B side. However, that next-hop has no arp entry, and a search for next-hop IP MAC (arp) is negative, no such next-hop IP exists. The router made a next-hop decision, and handed that off to L2, yet no forwarding was done, no positive forwarding decision made, etc.
A device (the logical process) that makes L3 next-hop decisions, is a router.
L3 decides next-hop, L2 decides how to forward.
L3 --> L2 (arp/cam) --> L1
^
fwd'ing
Quote from: BrandyWine on July 01, 2026, 10:44:02 PM[...]I believe in OPNsense we can do 2+ ports for a single bridge.[...]
I have... 6 physical interfaces on my (current) firewall, with another 9 via a 10-port switch (acting as a port expander, where ports 1-9 are assigned unique port VLANs and 10 is a tagged uplink plugged into the firewall). So 14 available interfaces, each assigned to one of four (non-transparent) bridges. Works great. Most folks here think it would give their network the plague. (Who knows? They might be right.)
Quote from: Jaapaap on July 01, 2026, 10:55:34 PM[...]It's pure hobby, but it does have to be functional. So please just tell me to drop the stupid project if that you pros opinions[...]
Nah, try it out. You can have a good old time trying different stuff. Never can tell. Could fix your back in short order.
Quote from: BrandyWine on July 02, 2026, 12:50:56 AMI know what she meant, but in technical terms she stated it incorrectly.[...]
Heh. Heck, grab her book - it's not bad. Or Rich Seifert's.
Quote from: BrandyWine on July 02, 2026, 12:50:56 AMIf I use the literal definition of forwarding ethernet frames, yes, she is wrong. There is no "forwarding" decisions being done at L3. There's only next-hop decision at L3, which is not "forwarding".
The action of an intermediate system to receive a frame for which it is not the final destination and passing it on based on some next hop decision has been called forwarding for decades. That's the definition of forwarding. I don't know where you get your "literal definition of forwarding ethernet frames" from. I suggest you read the definite textbook on the topic.
(https://m.media-amazon.com/images/I/71RTiCX7hFL._SY385_.jpg)
BTW: the sysctl variables that enable or disable routing (layer 3) in FreeBSD are called:
net.inet.ip.forwarding: 1
net.inet6.ip6.forwarding: 1
IIRC the CISCO CCNA book(s) mention(s) a Router doing Layer 3 Switching somewhere along the way, but I can't remember the exact context anymore :)
/ToMakeThingsEvenWeirder... LOL!
net.inet.ip.forwarding: 1
net.inet6.ip6.forwarding: 1
This only allows a packet to move across/traverse the internal routing engine. 0 = host-only mode, hence a packet that comes in on iface-A with L3 dst not in local subnet of iface-A, such packet goes straight into bit bucket, and perhaps an icmp response.
In reality, those conf setting, "forwarding" should have been "nexthop", because that setting is attached to "ip", which is L3.
Routing is always next-hop, switching is forwarding. People and their books have mangled terms over past xxx years. ;)
Take this saying: "a switch forwards packets, a router forwards packets".
So then whats the diff between a router and a switch?
As I mentioned before, a switch cannot make next-hop decision, it has no routing engine. A router however must have a switcher in it, otherwise no frames could move via L1 Tx & Rx.
So the known devices we commonly use:
L3/L2/L1 device ("router", next-hop L3 + forwarder L2)
L2/L1 device ("switch", forwarder L2)
;)
Perlman's (initial) work pre-dated or was contemporaneous to the development of the OSI model. Heck, for all I know she was in on it, as she contributed to DECNET and ISO standards such as CLNS/CLNP and IS-IS. (I believe she was also one of the DIX folks who transitioned to the IEEE 802 group. Seifert always thought Ethernet would dominate networking; back then I don't think anybody would have picked IP to dominate.)
Anyway, the OSI model is just a model. I can make a device that forwards using any information within the packet... or without. Conventions aid communication, though... most of the time.
Regardless of protocols, it's all about selecting (deciding) a port to Tx on. Non tcp-ip token ring, as example. Something in the logic decides which port the data should be fwd'd out of. Can also have no deciding at all, just a TxRx (port) pair (two devices 1port each), everything being Tx'd is being "fwd'd" to the Rx on other side. In tcp/ip we need the cam table for device to be able to "decide" which port a frame should be fwd'd (Tx'd) on.
L3 - where should I send this, what L3 address (route table)
L2 - go left, right, straight, or out the back (arp/cam)
L1 - Tx the frame (sending to the Rx on other side)
A routing table is commonly referred to as a FIB - a forwarding information base. And people like Perlman did not mangle terminology, they defined it.
The difference between a router and a switch/bridge is that a router works at layer 3 and a switch/bridge at layer 2. It is not necessary to invent separate terms for the act of passing a packet.
I give up.
Quote from: Patrick M. Hausen on July 03, 2026, 09:32:09 AMA routing table is commonly referred to as a FIB - a forwarding information base. And people like Perlman did not mangle terminology, they defined it.
The difference between a router and a switch/bridge is that a router works at layer 3 and a switch/bridge at layer 2. It is not necessary to invent separate terms for the act of passing a packet.
I give up.
Give up?
L3 FIB (next hop)
L2 ARP/CAM (where to forward)
L1 Tx
Seems 100% legit to me, there's no forwarding in L3.
"Forwarding" is the act of receiving and re-transmitting a packet regardless of the layer. It is not defined as a specifically layer 2 term.
The word "forward*" is in the "Router Requirements RFC" 278 times:
https://www.rfc-editor.org/info/rfc1812/
RFC's are not always very clear.
That RFC talks about "the forwarder" like it's a broker. RFC actually lumps L3 and L2 decision making into "the forwarder".
Data cannot move (actually fwd'd) between two devices w/o ARP from link layer, and the only way to L1 is from L2.
So if they want to call both L3 and L2 decision making "forwarding", then so be it, but when I trace the actual data it only moves via fwd'ing from L2 down to L1.
Routing engine says "next-hop is x.x.x.x, and use iface abc, now send down to link layer". That's all it does. ;)
Quote from: rfc(9) The forwarder performs any necessary IP fragmentation, as
described in Section [4.2.2.7]. Since this step occurs after
outbound interface selection (step 5), all fragments of the same
datagram will be transmitted out the same interface.
(10) The forwarder determines the Link Layer address of the packet's
next hop. The mechanisms for doing this are Link Layer-
dependent (see chapter 3).
(11) The forwarder encapsulates the IP datagram (or each of the
fragments thereof) in an appropriate Link Layer frame and queues
it for output on the interface selected in step 5
You were the one who started this mess by claiming Radia Perlman was using the term "forwarding" wrong. Well the entire networking world but you seems to use it like she does and I do. And I do not really understand your point. If you need to be precise, name the layer concerned.
(https://myimgs.org/storage/images/21917/router.png)