Interfaces: Virtual IPs: Settings > Mode=Other

[lmoore]

So, I thought this was a transparent firewall.

It is a Clayton's router - A router you use when you're not using a router.

Meaning of Clayton's: https://slang.com.au/c/claytons/

It seems the bridge is somewhere to park the Proxy ARP addresses to fool the traffic into passing through the traffic shaper.

[MK4L]

This is what it looks like!

You cannot view this attachment.

[Patrick M. Hausen]

He's bridging LAN and WAN and then transparently filtering as far as I get it. But there does not need to be any IP address on neither WAN nor LAN for that, and definitely no proxy ARP.

If you assign and enable the bridge depends on if you want to place the firewall rules and shaping on the individual interfaces or in the bridge interface. There are tunables for that.

In case of a "software switch", i.e. a LAN bridge, you generally filter on the bridge interface assigning that as LAN.

In case of a transparent filtering bridge you generally filter in the member interfaces as appropriate, if I am not mistaken.

[MK4L]

there does not need to be any IP address on neither WAN nor LAN for that, and definitely no proxy ARP.

I *do not* route in OPNSense. I just don't.

and shaping on the individual interfaces or in the bridge interface

Shaper *does not* work on a bridge. It has no effect whatsoever. I enforce 5 Mbps, the client gets 100.

[Patrick M. Hausen]

I did not say you route. I said if you bridge you do not need IP addresses. Bridging is layer 2. It's completely oblivious of any upper layer protocol like IPv4, IPv6, or (*gasp*) IPX or Appletalk.

[MK4L]

I did not say you route.

I totally understand. That is why I need Proxy ARP, because I do not want to put static routes in OPNSense. A bridge won't route for me.

Sorry, I retract that. Very long day. I did not want traffic to use the bridge as is because it skips Shaper rules.
I definitely tested that, with an IP that I did not assign to LAN, and it went out of shaper control.

[MK4L]

From Gemini:  I added a bridge device in OPNSense, did not assign it to interface, did not enable it, but it is always up after reboot. Explain.

brief: Not assigning the bridge deprives it the ability to work on layer 3. It will be up in all cases.

[Monviech (Cedrik)]

I ran this whole thread through Chatgpt and it says this (didnt fact check)

-----

FreeBSD actually documents this quite clearly.

A bridge does not need IP addresses to transparently forward traffic, and FreeBSD explicitly supports using a bridge as a traffic shaper with Dummynet. (FreeBSD Dokumentation)

The interesting part for your issue is if_bridge(4): bridged traffic can be filtered on the member interfaces or on the bridge itself, controlled by net.link.bridge.pfil_member and net.link.bridge.pfil_bridge. For Dummynet specifically, FreeBSD also documents net.link.bridge.ipfw as the Layer-2 filtering path and explicitly says it "needs to be enabled for dummynet(4) support." (FreeBSD Manpages)

FreeBSD if_bridge(4)
FreeBSD Handbook — Bridging

So I don't think Proxy ARP or VIPs are the solution here. If bridged packets bypass your shaper rules, the interesting question is which bridge filtering hook the packets and Dummynet rules are traversing. That's exactly what the FreeBSD bridge filtering knobs control.

https://man.freebsd.org/cgi/man.cgi?query=if_bridge&sektion=4

https://docs.freebsd.org/en/books/handbook/advanced-networking/#network-bridging

[Patrick M. Hausen]

Gemini is stating BS. You cannot deprive a bridge device from operating on layer 3. It never will, because a bridge is layer 2.