Interfaces: Virtual IPs: Settings > Mode=Other

[Patrick M. Hausen]

You can use a transparently bridged setup - no idea about the shaping, though. But remove the IP addresses from bridge member interfaces. That configuration breaks multicast and that might result in all sorts of mysterious issues.

I'd rather route whenever I can instead of bridging.

The official documentation for a transparent filtering bridge is here: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html

Kind regards,
Patrick

[MK4L]

But remove the IP addresses from bridge member interfaces

Looks like everyone is fixated on accusing me of doing that :D :D I just never do; this was the test setup I made *today* to see if non-transparent is going to work! And the bridge was a leftover from my prod setup!

Thank you for your dedicated help (Y)

[MK4L]

The official documentation for a transparent filtering bridge is here: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html

Oh yes :D Tis I, once again!

After staring at that page for so long I discovered this:
- This page is a Deja-Vu!
- I followed these steps to the character and ended up with toast routing.
- The steps, now, are outdated and do not represent current UI design/pages.
- Specifically, and since 2017 when I first read it, the system tunable instructions actually block routing (because there is no such thing as a Bridge interface to use in Firewall/Rules)

..which makes my setup unique and superior ;P

[MK4L]

And, yes: Please bring back VIP Mode=Other to the UI.

[lmoore]

because there is no such thing as a Bridge interface to use in Firewall/Rules

Verify the bridge interface is enabled



I have set up a transparent firewall using these instructions and it is working for me.

[lmoore]

Here's my list of interface assignments.

[dseven]

And, yes: Please bring back VIP Mode=Other to the UI.

Maybe I missed it, but I don't believe you have yet explained the purpose of this dummy/fake VIP. Maybe if you could explain, architecturally, what you're trying to do, and how this fake VIP fits into that, another solution can be found.

I still believe that a routed solution is the proper way, though. There's no reason (that I can see) for it not to work, if you stop contorting it with things like multiple default routes.

[MK4L]

because there is no such thing as a Bridge interface to use in Firewall/Rules

Verify the bridge interface is enabled



I have set up a transparent firewall using these instructions and it is working for me.

This setting vanished somewhere between upgrades...
I'm on latest OPNsense 26.7.2_2-amd64 FreeBSD 15.1-RELEASE-p2 OpenSSL 3.5.7

[MK4L]

Here's my list of interface assignments.

This listing also vanished.
Bridge interfaces are now either created, or not.
I'm on latest OPNsense 26.7.2_2-amd64 FreeBSD 15.1-RELEASE-p2 OpenSSL 3.5.7

[MK4L]

you have yet explained the purpose of this dummy/fake VIP

I wish I could, form a sound BSD perspective.

But, like I said:

- Attached is my prod setup full list of System: Routes: Status
- You see, I only have a route to the admin interface (OPT1) where I connect and where the system gets it own updates (and resolves DNS in the way).
- Not a single other route is there.
- From your description, you should be surprised to know that I have 15 pairs of Pseudo Other-mode interfaces, total of 30, plus 1 for the larger LAN IP subnet.
- From your description, you should be surprised to know that, without these, no routing is done.
- The Other-mode IPs are created in *pairs* that are *conflicting*-and-*matching* the actual IPs on both routers. I think this would give you an idea how it works, which I cannot explain in informed literature!
- What I was helplessly trying to do with that is *enforce* OPNSense to somehow route traffic where I want it to go, without assigning any IPs, AND, without causing any ARP disturbance. When I did that in 2017, it was a helpless attempt *based on the docs description of Mode=Other*

Please note that I still have the system tunables from the docs page at default values. When I modify them, routing commits suicide.


You cannot view this attachment.

[MK4L]

you have yet explained the purpose of this dummy/fake VIP

I wish I could, form a sound BSD perspective.

But, like I said:

- Attached is my prod setup full list of System: Routes: Status
- You see, I only have a route to the admin interface (OPT1) where I connect and where the system gets it own updates (and resolves DNS in the way).
- Not a single other route is there.
- From your description, you should be surprised to know that I have 15 pairs of Pseudo Other-mode interfaces, total of 30, plus 1 for the larger LAN IP subnet.
- From your description, you should be surprised to know that, without these, no routing is done.
- The Other-mode IPs are created in *pairs* that are *conflicting*-and-*matching* the actual IPs on both routers. I think this would give you an idea how it works, which I cannot explain in informed literature!
- What I was helplessly trying to do with that is *enforce* OPNSense to somehow route traffic where I want it to go, without assigning any IPs, AND, without causing any ARP disturbance. When I did that in 2017, it was a helpless attempt *based on the docs description of Mode=Other*

Please note that I still have the system tunables from the docs page at default values. When I modify them, routing commits suicide.


You cannot view this attachment.

And, guess what? It just worked! For almost 10 years.

[Monviech (Cedrik)]

Maybe it's time to move on to a supported setup and not an accidental side effect.

If it cannot be explained properly and everybody is confused occam's razor makes it look like this:
https://xkcd.com/1172/

[lmoore]

- The Other-mode IPs are created in *pairs* that are *conflicting*-and-*matching* the actual IPs on both routers

This suggests you are experiencing ARP issues over the bridge where the router on the other side of the bridge does not receive the ARP request and/or vice-versa.

A transparent firewall does not route traffic, it is simply a bridge inserted in the path of a network connection going from point A to point B.

On my test machine I have a default route on the LAN interface going to my production OPNsense router. Based upon your drawing earlier, this is the Internal Router.

Please note that I still have the system tunables from the docs page at default values. When I modify them, routing commits suicide.

If you didn't reconfigure your firewall rule/s to use the Bridge interface, then this is expected when you change the Tunables to filter on the bridge.

[MK4L]

This suggests you are experiencing ARP issues over the bridge where the router on the other side of the bridge does not receive the ARP request and/or vice-versa.

A transparent bridge operates by forwarding Ethernet frames based on MAC addresses. It doesn't look at IP addresses or make routing decisions.
Since I'm not interested in messing up the routing AS IT IS in my setup, I will never set a default route to the WAN.

I have multiple destination networks on both sides, and I'm not giving that up. Ever.

[MK4L]

If it cannot be explained properly and everybody is confused occam's razor makes it look like this:
https://xkcd.com/1172/

Believe me I tried, but your heating children are standing in my way :D :D