Topics

[Hardware Initial Setup]

This how-to aims to guide you through the easy configuration of a Transparent Filtering Bridge on the OPNsense firewall, as explained below.


1. Hardware Initial Setup

Ensure you have at least 3 network interfaces:

LAN (internal network)
WAN (internet connection)
Additional interface for bridge

2. Bridge Configuration

Access Interfaces → Other Types → Bridge
Click "+" to add a new bridge
Configure the following parameters:

Code Select Expand

Description: Bridge_LAN_WAN
Member interfaces: [Select your interfaces]
Enable: checked
Advanced options: Keep default settings
Click "Save"

3. Interface Configuration

Go to Interfaces → Assignments
Add the newly created bridge
Configure member interfaces:

Code Select Expand

IPv4/IPv6 Configuration Type: none
IP address: leave empty
MTU: default
Device Configuration:
- Promiscuous mode: checked

4. Firewall Configuration

Access Firewall → Rules
Configure bridge rules:

Code Select Expand

Action: pass/block
Interface: [your_bridge]
Direction: in/out
Protocol: any/specific
Source/Destination: as needed

5. Enable Filtering

Go to System → Settings → Tunables
Add or verify these parameters:

Code Select Expand

net.link.bridge.pfil_member=1
net.link.bridge.pfil_bridge=0

6. System Commands for Verification:

Code Select Expand

# Check bridge status
ifconfig bridge0

# Verify interface status
ifconfig em0
ifconfig em1

# Check system logs
tail -f /var/log/system.log

# Monitor bridge traffic
tcpdump -i bridge0

7. Network Testing Commands:

Code Select Expand

# Test connectivity
ping 1.1.1.1

# Check routing table
netstat -rn

# View bridge status
pfctl -s state

# Monitor interface traffic
tcpdump -ni em0

Important Tips

- Back up the configuration before starting

- Maintain physical access to the equipment during configuration

- Document all changes made

- Test in a controlled environment before deploying to production

Common Troubleshooting

Check Connectivity:

Code Select Expand

# Check interface status
ifconfig

# View system messages
dmesg | tail

# Check firewall logs
tail -f /var/log/filter.log

Check Bridge:

Code Select Expand

# Bridge status
ifconfig bridge0

# Bridge statistics
pfctl -s info

Monitoring:

Code Select Expand

# Real-time traffic monitoring
tcpdump -ni bridge0

# System status
top