Interfaces: Virtual IPs: Settings > Mode=Other

[lmoore]

So, I thought this was a transparent firewall.

It is a Clayton's router - A router you use when you're not using a router.

Meaning of Clayton's: https://slang.com.au/c/claytons/

It seems the bridge is somewhere to park the Proxy ARP addresses to fool the traffic into passing through the traffic shaper.

[MK4L]

This is what it looks like!

You cannot view this attachment.

[Patrick M. Hausen]

He's bridging LAN and WAN and then transparently filtering as far as I get it. But there does not need to be any IP address on neither WAN nor LAN for that, and definitely no proxy ARP.

If you assign and enable the bridge depends on if you want to place the firewall rules and shaping on the individual interfaces or in the bridge interface. There are tunables for that.

In case of a "software switch", i.e. a LAN bridge, you generally filter on the bridge interface assigning that as LAN.

In case of a transparent filtering bridge you generally filter in the member interfaces as appropriate, if I am not mistaken.

[MK4L]

there does not need to be any IP address on neither WAN nor LAN for that, and definitely no proxy ARP.

I *do not* route in OPNSense. I just don't.

and shaping on the individual interfaces or in the bridge interface

Shaper *does not* work on a bridge. It has no effect whatsoever. I enforce 5 Mbps, the client gets 100.

[Patrick M. Hausen]

I did not say you route. I said if you bridge you do not need IP addresses. Bridging is layer 2. It's completely oblivious of any upper layer protocol like IPv4, IPv6, or (*gasp*) IPX or Appletalk.

[MK4L]

I did not say you route.

I totally understand. That is why I need Proxy ARP, because I do not want to put static routes in OPNSense. A bridge won't route for me.

Sorry, I retract that. Very long day. I did not want traffic to use the bridge as is because it skips Shaper rules.
I definitely tested that, with an IP that I did not assign to LAN, and it went out of shaper control.

[MK4L]

From Gemini:  I added a bridge device in OPNSense, did not assign it to interface, did not enable it, but it is always up after reboot. Explain.

brief: Not assigning the bridge deprives it the ability to work on layer 3. It will be up in all cases.

Scrap that; AI slop.

[Monviech (Cedrik)]

I ran this whole thread through Chatgpt and it says this (didnt fact check)

-----

FreeBSD actually documents this quite clearly.

A bridge does not need IP addresses to transparently forward traffic, and FreeBSD explicitly supports using a bridge as a traffic shaper with Dummynet. (FreeBSD Dokumentation)

The interesting part for your issue is if_bridge(4): bridged traffic can be filtered on the member interfaces or on the bridge itself, controlled by net.link.bridge.pfil_member and net.link.bridge.pfil_bridge. For Dummynet specifically, FreeBSD also documents net.link.bridge.ipfw as the Layer-2 filtering path and explicitly says it "needs to be enabled for dummynet(4) support." (FreeBSD Manpages)

FreeBSD if_bridge(4)
FreeBSD Handbook — Bridging

So I don't think Proxy ARP or VIPs are the solution here. If bridged packets bypass your shaper rules, the interesting question is which bridge filtering hook the packets and Dummynet rules are traversing. That's exactly what the FreeBSD bridge filtering knobs control.

https://man.freebsd.org/cgi/man.cgi?query=if_bridge&sektion=4

https://docs.freebsd.org/en/books/handbook/advanced-networking/#network-bridging

[Patrick M. Hausen]

Gemini is stating BS. You cannot deprive a bridge device from operating on layer 3. It never will, because a bridge is layer 2.

[MK4L]

I had to do it, so i just did. Nothing is like debugging on prod! ;D

This is 100% tested, using all combinations, surviving too many reboots, so there is 0% chance it had accidental results.
This is the correct setup for OPNSense in-line TRANSPARENT BRIDGE shaper: (Corrections made with help from @Cedrik (Y) )

- LAN interface IP assignments are NONE. (Interfaces: [LAN])
- WAN interface IP assignments are NONE. (Interfaces: [WAN])
- Create a Bridge Device combining LAN + WAN. (Interfaces: Devices: Bridge)
- You can assign an interface to the Bridge Device (Interfaces: Assignments), but it does not matter.
- You can enable the Bridge Device, but it will be UP in any scenario on its own.
- Set Firewall rules to allow all-to-all traffic in both directions for LAN + WAN. (Firewall: Rules)
- DO NOT use Virtual IPs of any mode, whatsoever. (Interfaces: Virtual IPs: Settings)
- Add tunable > net.link.bridge.ipfw > set to 1 > Apply. (System: Settings: Tunables)
- Create your Traffic Shaper Pipes and Rules. (Firewall: Shaper)


What you DO NOT need:
- Allowing 2-way all-to-all traffic to pass the bridge device in the firewall. Filtering happens on the LAN & WAN interfaces.
- Adding Virtual IPs of any mode, or even actual IPs to that matter. It breaks current FreeBSD rules if you add them to bridge members.
- Adding static routes in OPNSense. You route in your routers. You do not need to route in OPNSense, forwarding works normally.
- Modify .pfil_ System Tunables. You only need to (System: Settings: Tunables)Add tunable > net.link.bridge.ipfw > set to 1 > Apply:

From FreeBSD ManPages

net.link.bridge.ipfw
        Set to 1 to enable layer2 filtering with ipfirewall(4), set to 0 to
        disable  it.  This  needs  to  be enabled for dummynet(4) support.
        When ipfw is enabled, pfil_bridge and pfil_member will be    disabled
        so that IPFW is not run twice; these can be re-enabled if desired.

@franco: You can kill the cruft!
@everyone: Thank you so much for caring to reply. Pushing is healthy.
@Cedrik: Special thanks for the time you took to help and your remarks.

[Monviech (Cedrik)]

Now that sounds more like it.

It means that for IPFW dummynet shaping it needs an additional tunable.

But that also means without that tunable, shaping via PF should also work (which is available in the new Rules, you can attach pipes via PF there so PF sends it to dummynet, IPFW is not needed then. But its still a bit wonky probably)

[MK4L]

a bit wonky

Yes, cluttered, messy, and split over 2 pages!

You cannot view this attachment.


Off-topic: If you like DeepHouse, this is a little AI thank you :D You will be surprised.

https://www.youtube.com/watch?v=sPk2viKd0cE
https://www.youtube.com/watch?v=6K7PQviILDg

[dgrns]

@MK4L just an outside observer on this; seems like the distilled version would be a great add to "Tutorials and FAQ"

[lmoore]

It means that for IPFW dummynet shaping it needs an additional tunable.

A little more is required.

I suspect I know the reason why fudging of ARP was initially used in @MK4L's environment.

I'm including the steps required to set up a Transparent Traffic Shaper based upon @MK4L's description of their environment.

Code Select Expand

Overview:

    Guide to build a Transparent Traffic Shaper using OPNsense.
   
    The configuration steps described here is based upon @MK4L's description of their environment.

    Some points for the keen observer;
     - The bridge interface has not been assigned in Interfaces -> Assignments and is not required.
     - This configuration can work without any PF rules applied to the WAN & LAN interfaces by adjusting one setting.

    These instructions were performed on bare-metal hardware which included the following NIC's and their assignments:
     - em0         -> [OPT1]
     - igb0        -> [LAN]
     - igb1        -> [WAN]
   
    The version of OPNsense used when creating this configuration: OPNsense 26.7.2_2 (amd64)
   
    With exception to the interface names, follow the steps verbatim and in order as listed.

Requirements:

 - Computer meets OPNsense system requirements
 - Computer has a minumum of 3 x NIC's

Assumptions:

 - The reader is familiar with configuring OPNsense
 - The computer being used for this installation is a test machine

Disclaimer:

    There may be errors or omissions in the steps below.


Priot to perfoming the following instructions, prepare your system using one of these two options.

 1) Perform a fresh installation and at the end shut down and power off the computer.
 2) Reset OPNsense settings to factory defaults.
 
First time start-up and initial configuration using LAN interface:

 - Remove all network cables from the computer
 - Power on computer
 - Wait for the computer to display the login prompt on the console.
 - Plug a network cable into the LAN port
 - Login on the console as root
 - Select option 2 - Set interface IP address
 - Enter 1 - LAN listed under 'Available interfaces'
 - Enter 'y' to assign an IPv4 address using DHCP
 - Enter 'n' to disable IPv6 WAN tracking
 - Enter 'N' to not use DHCP6
 - Press Enter to skip entering an IPv6 address
 - Press Enter to skip GUI protocol
 - Press Enter to skip GUI certificate
 - Press Enter to skip GUI access defaults
 - Log on to the WebGUI
 - Interfaces -> Neighbors -> Automatic Discovery
    - Enabled: untick
    - Click 'Apply'
 - Interfaces -> Assignments
    - Add
    - Select device from drop-down list: em0
    - Click 'Save'
    - Click 'Apply'
 - Refresh browser page (F5)
 - Interfaces -> [OPT1]
     - Enable: tick to enable the interface
    - IPv4 Configuration Type: DHCP
    - IPV6 Configuration Type: <optional>
    - Click 'Save'
    - Click 'Apply changes'
 - Firewall -> Rules
    - Edit Interface rule Default allow LAN to any rule
        - Enable 'adavanced mode'
        - Description: <optional>
        - Interface: Include 'OPT1'
        - Source: Include 'OPT1 network'
        - Disable reply-to: tick
        - Click 'Save'
    - Edit Interface rule Default allow LAN IPv6 to any rule
        - Enable 'adavanced mode'
        - Description: <optional>
        - Interface: Include 'OPT1'
        - Source: Include 'OPT1 network'
        - Disable reply-to: tick
        - Click 'Save'
        - Click 'Apply'
 - Lobby -> Logout
 - Close the browser
 - Unplug the network cable from the LAN port
 - Plug the network cable in to the OPT1 port
 - On the console select 0 to logout
 - Log back in on the console as root
 - Open a new browser to the address listed on the console for OPT1
 - Log on to the WebGUI

Complete System Configuration Wizard

 - Welcome tab
    - Click 'Next'

 - General Information tab
     - Hostname: TTS-IPFW
    - Timezone: <optional>
    - DNS servers: Enter address of internal DNS server
    - Click 'Next'

 - Network [WAN] tab
    - Disable LAN: tick
    - Block RFC1918 Private Networks: untick
    - Block bogon networks: untick
    - Click 'Next'

 - Network [LAN] tab
    - Disable LAN: tick
    - Configure IP address: clear text in field 'dhcp/'
    - Configure DHCP server: untick
    - Click 'Next'

 - Deployment type tab
    - Optimize for Multiwan: untick
    - Automatic DHCP/DNS registration: untick
    - Click 'Next'

 - Set initial password tab
    If not already changed from its default, change the Root Password.
    - Click 'Next'

 - Finish tab
    - Click 'Apply'

Configure LAN & WAN interfaces

 - Interfaces -> LAN
    - Enable: tick
    - IPv4 Configuration Type: None
    - IPV6 Configuration Type: None
    - Click 'Save'
    - Click 'Apply changes'
 - Interfaces -> WAN
    - Enable: tick
    - Block private networks: untick
    - Block bogon networks: untick
    - IPv4 Configuration Type: None
    - IPV6 Configuration Type: None
    - Click 'Save'
    - Click 'Apply changes'

Update firewall settings

 - Firewall -> NAT -> Source NAT
    - Mode: Disable Source NAT rule generation
    - Click 'Apply'
 - Firewall -> Rules
    - Edit Interface rule Default allow LAN to any rule
        - Description: <optional>
        - Interface: Deselect 'LAN'
        - Source: Deselect 'LAN network'
        - Click 'Save'
    - Edit Interface rule Default allow LAN IPv6 to any rule
        - Description: <optional>
        - Interface: Deselect 'LAN'
        - Source: Deselect 'LAN network'
        - Click 'Save'
        - Click 'Apply'

Enable sysctl options required for this configuration.

 - System -> Settings -> Tunables
    - Add
    - Tuneable: net.link.bridge.ipfw
    - Value: 1
    - Description: Layer2 filter with IPFW
    - Click 'Save'
 - System -> Settings -> Tunables
    - Add
    - Tuneable: net.link.ether.ipfw
    - Value: 1
    - Description: Pass ether pkts through firewall
    - Click 'Save'

 - Services -> Unbound -> Query Forwarding
    - Use System Nameservers: tick
    - Click 'Apply'

Add a Bridge device with description 'Traffic Shaper' and include the EGRESS and INGRESS interfaces as members and click on Save

  - Interfaces -> Devices -> Bridge
    - Add
    - Member interfaces: WAN, LAN
    - Description: Traffic Shaper
    - Click 'Save'
    - Click 'Apply'

Create firewall rule for the bridge.

 - Firewall -> Rules
    - Add
    - Enable 'advanced mode'
    - Description: Traffic Shaper
    - Interface: LAN, WAN
    - Direction: Both
    - State type: no state
    - Click Save
    - Click Apply

Create shaping pipes

 - Firewall -> Shaper -> Pipes
    - Create Download pipe
        - Add
        - Bandwidth: 4
        - Bandwidth Metric: Mbit/s
        - Description: Pipe_4Mbps
        - Click 'Save'
    - Create Upload pipe
        - Add
        - Bandwidth: 2
        - Bandwidth Metric: Mbit/s
        - Description: Pipe_2MBps
        - Click 'Save'
        - Click 'Apply'

Create shaping rules

 - Firewall -> Shaper -> Rules
    - Create Download rule for subnet 10.200.128.0/24
        - Add
        - Enable 'advanced mode'
        - Enabled: ticked
        - Interface: WAN
        - Interface 2: LAN
        - Source: any
        - Destination: 10.200.128.0/24
        - Direction: In
        - Target: Pipe_4MBps
        - Description: Shape traffic for subnet 10.200.128.0/24
        - Click 'Save'
    - Create Upload rule for subnet 10.200.128.0/24
        - Add
        - Enable 'advanced mode'
        - Enabled: ticked
        - Interface: WAN
        - Interface 2: LAN
        - Source: 10.200.128.0/24
        - Destination: any
        - Direction: Out
        - Target: Pipe_4MBps
        - Description: Shape traffic from subnet 10.200.128.0/24
        - Click 'Save'
        - Click 'Apply'

Check for updates

 - Check for OPNSense updates and install if available

Final reboot
 - Power -> Reboot
    - Click 'Yes'


Plug appropriate network cables in to the LAN & WAN ports and commence testing. Enjoy!

[notspam]

The problem is a bit the thread starter itself.
Without knowledge of basic network design rules all effort is in reality a waste of time.
It is important to seriously consider the issues and not just start building without a plan.
I have rarely read so many false things.