"
Hello,
I have been able to get a Linux VM running with vm-bhyve on OPNsense, but I'm having trouble getting a stable network connection to a VLAN.
What I see is when the VM boots up the firewall filters the VM's tap interface and deny entries against the tap interface show in the logs. After roughly 18-20 minutes, deny logs stop and packets flow through the VLAN rule set. I setup a script that makes DNS requests until it's successful, logs how long it takes, and reboots the VM. Out of ~35 iterations, most times DNS request succeed in the 18-20 minute range.
I used `vm switch create` to make a switch on a vlan interface `ix2_vlan66`. This creates a bridge interface, which I assigned in the UI, and an entry for it became available in the firewall rules section. In the firewall I create a single rule that allows everything. From what I can tell, that rule is used to allow DHCP to work; all other packets appear to be processed with the VLAN's rules.
Per instructions on "How to set up a LAN Bridge" [1] I set `net.link.bridge.pfil_member` to 0 and net.link.bridge.pfil_bridge to 1.
Any thoughts on what might be causing this? Ideally the correct firewall rules would be applied to the VM immediately without the delay. It seems like `net.link.bridge.pfil_member` and `net.link.bridge.pfil_bridge` tunables take effect on the tap interface/new members to the bridge after ~18 minutes.
Thank you!
[1] https://docs.opnsense.org/manual/how-tos/lan_bridge.html
I have been able to get a Linux VM running with vm-bhyve on OPNsense, but I'm having trouble getting a stable network connection to a VLAN.
What I see is when the VM boots up the firewall filters the VM's tap interface and deny entries against the tap interface show in the logs. After roughly 18-20 minutes, deny logs stop and packets flow through the VLAN rule set. I setup a script that makes DNS requests until it's successful, logs how long it takes, and reboots the VM. Out of ~35 iterations, most times DNS request succeed in the 18-20 minute range.
I used `vm switch create` to make a switch on a vlan interface `ix2_vlan66`. This creates a bridge interface, which I assigned in the UI, and an entry for it became available in the firewall rules section. In the firewall I create a single rule that allows everything. From what I can tell, that rule is used to allow DHCP to work; all other packets appear to be processed with the VLAN's rules.
Per instructions on "How to set up a LAN Bridge" [1] I set `net.link.bridge.pfil_member` to 0 and net.link.bridge.pfil_bridge to 1.
Any thoughts on what might be causing this? Ideally the correct firewall rules would be applied to the VM immediately without the delay. It seems like `net.link.bridge.pfil_member` and `net.link.bridge.pfil_bridge` tunables take effect on the tap interface/new members to the bridge after ~18 minutes.
Thank you!
[1] https://docs.opnsense.org/manual/how-tos/lan_bridge.html
