Interfaces: Virtual IPs: Settings > Mode=Other

[lmoore]

This is my setup; I wanted to place OPNSense between 2 routers to do what it is supposed to do: SHAPE TRAFFIC.

Would it be better to say you have a transparent firewall with traffic shaping?

What purpose do the VIP's serve in your configuration?

[notspam]

The truth is that he only want a "layer 2 only / traffic shaping box".

[lmoore]

The truth is that he only want a "layer 2 only / traffic shaping box".

Yes, I understand that. The configuration has VIP's assigned to LAN A1, LAN A2, WAN A1 & WAN A2, the purpose of which is unclear.

[dseven]

The truth is that he only want a "layer 2 only / traffic shaping box".

In my interpretation; they want a traffic shaping box, but they were unable to get (layer 3) routing to work they way that they expected it to, so they cobbled something together with a transparent bridge instead...

[MK4L]

The truth is that he only want a "layer 2 only / traffic shaping box".

In my interpretation; they want a traffic shaping box, but they were unable to get (layer 3) routing to work they way that they expected it to, so they cobbled something together with a transparent bridge instead...

That was exactly the case, 10 years ago!
For the question about what the Other mode VIPs are doing: they allow traffic to be routed *without any static routes*. The system does not even generate dynamic routes for the Other mode VIPs, but routing works exactly like I expect it to.

Not sure what I did back then, but I have just completed the testing *now* and it worked!
No VIPs, only static routing and 2 manual Gateways.


Thank you all so much for your interest to help.

[lmoore]

Other mode VIPs are doing: they allow traffic to be routed *without any static routes*.

I wonder if the routing issue back then was to do with ARP.

Glad it's all working for you!

[MK4L]

The truth is that he only want a "layer 2 only / traffic shaping box".

In my interpretation; they want a traffic shaping box, but they were unable to get (layer 3) routing to work they way that they expected it to, so they cobbled something together with a transparent bridge instead...

I am back to square 1. I recalled all the pain of the past.
I know why I chose to make it transparent!
When you start assigning IP addresses to WAN/LAN interfaces in the first place, 2 ugly things happen:

- UI navigation becomes very much slower and lagging.
- Routing decisions must be taken *on* OPNSense. Routing becomes horribly unreliable.

Like, I only rebooted, and I lost access to the console from OPT1, which I setup for admin access.

This is my test setup...

Interfaces...
LAN Interface: 192.168.10.2/24
WAN Interface: 192.168.11.2/24
OPT1: DHCP IP 172.16.100.6/24, GW 172.16.100.1
Bridge: I should have removed that from prod setup, but it should not really matter, WAN+LAN combined in Bridge0.

Firewall...
- Admin access is allowed only from OPT1 for admin IP 172.16.100.100/24
- IPv4 is allowed IN/OUT using a floating rule
- IPv6 is all dropped

NAT: Disabled IN/OUT. Completely disabled.

Gateways...
LAN-G: 192.168.10.1/24 on LAN (priority 255, connected to completely *open* router Forward/Input)
WAN-G: 192.168.11.1/24 on WAN (priority 255, connected to completely *open* router Forward/Input)
Dynamic OPT1 GW 172.16.100.1/24 on OPT1 (priority 254)

Routing...
Route 1: 10.10.10.0/24 next-hop LAN-G
Route 2: 10.10.11.0/24 next-hop WAN-G

Test...
- Ping from 10.10.10.2 -> 10.10.11.2 (success)
- Ping from 10.10.11.2 -> 10.10.10.2 (success)
- Shaper rules test on file copy (success)
After reboot setup was *still* working but console UI was completely blocked on OPT1


I must have hit a very similar scenario where I realized that OPNSense, if left to its own devices, does horrible routing/blocking decisions on its own, and if not, at least UI navigation becomes very much slower and lagging.


What I have been able to achieve using VIP=Other, for almost 10 years:
- Never get UI console blocked at OPT1.
- Completely secure access to UI console.
- Decision-less, *constant*, and *reliable* layer-3 routing.
- UI navigation is super fast and super reliable.

How I do it (example)...
LAN interface *no* IP assigned, whatsoever
WAN interface *no* IP assigned, whatsoever
Bridge0 combine LAN+WAN
Internal router with IP 192.168.10.1/30
Edge router with IP 192.168.10.2/30
VIP(Other) 192.168.10.1/32 on LAN interface
VIP(Other) 192.168.10.2/32 on WAN interface
Firewall floating rule allow IPv4 from all-to-all in both directions

...and it just works. No surprises. No lag. No blocking. Super reliable.