Interfaces: Virtual IPs: Settings > Mode=Other

[Patrick M. Hausen]

You can use a transparently bridged setup - no idea about the shaping, though. But remove the IP addresses from bridge member interfaces. That configuration breaks multicast and that might result in all sorts of mysterious issues.

I'd rather route whenever I can instead of bridging.

The official documentation for a transparent filtering bridge is here: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html

Kind regards,
Patrick

[MK4L]

But remove the IP addresses from bridge member interfaces

Looks like everyone is fixated on accusing me of doing that :D :D I just never do; this was the test setup I made *today* to see if non-transparent is going to work! And the bridge was a leftover from my prod setup!

Thank you for your dedicated help (Y)

[MK4L]

The official documentation for a transparent filtering bridge is here: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html

Oh yes :D Tis I, once again!

After staring at that page for so long I discovered this:
- This page is a Deja-Vu!
- I followed these steps to the character and ended up with toast routing.
- The steps, now, are outdated and do not represent current UI design/pages.
- Specifically, and since 2017 when I first read it, the system tunable instructions actually block routing (because there is no such thing as a Bridge interface to use in Firewall/Rules)

..which makes my setup unique and superior ;P

[MK4L]

And, yes: Please bring back VIP Mode=Other to the UI.

[lmoore]

because there is no such thing as a Bridge interface to use in Firewall/Rules

Verify the bridge interface is enabled



I have set up a transparent firewall using these instructions and it is working for me.

[lmoore]

Here's my list of interface assignments.

[dseven]

And, yes: Please bring back VIP Mode=Other to the UI.

Maybe I missed it, but I don't believe you have yet explained the purpose of this dummy/fake VIP. Maybe if you could explain, architecturally, what you're trying to do, and how this fake VIP fits into that, another solution can be found.

I still believe that a routed solution is the proper way, though. There's no reason (that I can see) for it not to work, if you stop contorting it with things like multiple default routes.