Interfaces: Virtual IPs: Settings > Mode=Other

[MK4L]

- I know OPNSense removed this from the UI.
- I know it was announced.
- I know it is still supported if you export config, edit config, re-import config.
- I do not really understand why it was removed?
- OPNSense is missing on a very important use case: Transparent Shaper.
- A Transparent Shaper is possible ONLY using Interfaces: Virtual IPs: Settings > Mode=Other.

More details why:
- Queuing is never efficient; only pipes are.
- Queuing is never efficient, from any vendor, software or hardware, or both (appliance); only pipes are.
- A shaper is best when transparent.
- A Shaper is best when standalone.
- Any additional service is pure noise.


This is more of a feature request: Please bring back Virtual IP Mode = Other to the UI. Adding "Other" interfaces does not mean I have to restart the shaper.

[franco]

> community/25.1/25.1.3:o interfaces: remove defunct "other" VIP type

To our knowledge it wasn't even creating a VIP, just being selectable in some legacy pages as a single pseudo-alias and we simply did not want to bring this cruft into MVC to ease future maintenance burden.


Cheers,
Franco

[MK4L]

> community/25.1/25.1.3:o interfaces: remove defunct "other" VIP type

To our knowledge it wasn't even creating a VIP, just being selectable in some legacy pages as a single pseudo-alias and we simply did not want to bring this cruft into MVC to ease future maintenance burden.


Cheers,
Franco

The problem is: You cannot use OPNSense like a ROUTER-THAT-DOES-NOT-NAT-AND-STILL-HAVE-FIREWALL *except* with this trick.

- I do not want NAT.
- I do not want anything *except* a SHAPER THAT ROUTES and that HAS A FIREWALL.
- Traffic insights are a bonus!

Do you see any way to achieve that other than with VIP=Other?
Config snips attached.

[dseven]

The problem is: You cannot use OPNSense like a ROUTER-THAT-DOES-NOT-NAT-AND-STILL-HAVE-FIREWALL *except* with this trick.

I'm probably missing something, but if you don't want NAT, don't configure NAT?

You may have to disable source NAT, which is "Automatic" by default:

Firewall -> NAT -> Source NAT, set Mode to "Disable ..."

[franco]

> Do you see any way to achieve that other than with VIP=Other?

I just don't understand the problem to be honest.

What's the use of a VIP that doesn't create a VIP in the grand scheme of things?  How does it flaw the firewall in your view?


Cheers,
Franco

[MK4L]

The problem is: You cannot use OPNSense like a ROUTER-THAT-DOES-NOT-NAT-AND-STILL-HAVE-FIREWALL *except* with this trick.

I'm probably missing something, but if you don't want NAT, don't configure NAT?

You may have to disable source NAT, which is "Automatic" by default:

Firewall -> NAT -> Source NAT, set Mode to "Disable ..."

Already disabled.

[MK4L]

> Do you see any way to achieve that other than with VIP=Other?

I just don't understand the problem to be honest.

What's the use of a VIP that doesn't create a VIP in the grand scheme of things?  How does it flaw the firewall in your view?


Cheers,
Franco

- When I first used OPNSense, like 10 years ago, I tried static routing.
- With all NAT disabled, routing just *did not function in any way possible*.
- After too many trials, I said to myself: to the dump with it, make it transparent; bump in the wire.
- And it just worked; only with VIP=Other

This is my setup; I wanted to place OPNSense between 2 routers to do what it is supposed to do: SHAPE TRAFFIC.

VIP=Other is the only way it worked for me.

[franco]

Sorry, I'm lost.


Cheers,
Franco

[MK4L]

Setup in attached image. How do you suggest to do it without VIP=Other?

[MK4L]

BTW, I only need the firewall to protect the OPNSense shaper; I do not give a blink what passes through. If you took a look at the config snips you will know that I already combined LAN+WAN into a single BRIDGE.

[dseven]

When I first used OPNSense, like 10 years ago, I tried static routing.
- With all NAT disabled, routing just *did not function in any way possible*.

I don't know what issues may have existed 10 years ago, but this is not normal. Can you demonstrate OPNsense failing to function as a non-NAT router today?

[MK4L]

When I first used OPNSense, like 10 years ago, I tried static routing.
- With all NAT disabled, routing just *did not function in any way possible*.

I don't know what issues may have existed 10 years ago, but this is not normal. Can you demonstrate OPNsense failing to function as a non-NAT router today?

i will see if I can create a test VM for that, and get back to you.

[notspam]

A transparent shaper ?
Traffic shaping is by nature "transparent". All traffic passes the txqueue and you "simply" apply some fancy algorithms as managers of the txqueue.

Sounds strange your setup.
Is it a bridge or a routed device ? It is a bridge.
You use two different Interfaces? Lan and Wan are bridged.

Pipes and Queues are implemented in OPNsense to bind it on interfaces.

Every simple datacenter router or switch is capable to control the traffic flow. Why not implement it directly on the two routers ?

If you make a setup out of scope, why not use BSD native instead of OPNsense?
This will be the best for you and you have "no noisy disturbing services" as you wrote before.

[Seimus]

From the picture you shared,

This looks like a transparent bridge e.g a transparent FW.
Is your point about, you are worried that you can not without that feature create a transparent bridge?

Regards,
S.

[Monviech (Cedrik)]

When I updates this doc I also took the note from the old page that the traffic shaper is not supported for transparent bridges:

https://docs.opnsense.org/manual/how-tos/transparent_bridge.html

Maybe something is missing? Did it ever work and the assumption is wrong?