Transparent Filtering Bridge: How configure Ethernet port as a management port?

[psehorne]

Hello, group.

I did a search for an answer to my problem but did find any help.

I'm trying to set up newly installed OPNsense 26.7 (my first installation of OPNsense) as a transparent filtering bridge between my ISP and my router. I cannot access the GUI via my management port.  I can access it via the LAN port, and both ports are configured the same except for the IP address.

The machine is a mini PC with two real Ethernet ports (LAN re0 and WAN re10).  I added a USB Ethernet to us as the management port (MGMT ue0).
With the Ethernet cable from  my PC connect to the LAN (re0) port I can access the GUI.  With it connected to the MGMT (ue0) port I cannot access the GUI. (I have verified the USB Ethernet adapter works properly and that the Ethernet cables I am using are fine.)

There is a bridge also configured whose members include LAN, WAN, and MGMT.

The LAN port (192.168.1.35) and the MGMT port (192.168.1.36) both have an IP address.  From the LAN port I can ping both IP addresses.  From the MGMT port I cannot access the GUI, and pings from my PC timeout.

I have also tried giving the bridge an IP address (192.168.1.37).  From the LAN port I could access the GUI and ping all three IP addresses.  From the MGMT port I cannot ping any of the three address and cannot access the GUI.

Before I add any restrictive firewall rules, I have added firewall rules allowing packets from each port to pass unrestricted.  This works.  When I place the mini PC between my router and the ISP I can access the internet as expected.  However without a working MGMT port I cannot administer the OPNsense instance.

Any ideas from the group as to how to configure this setup?

Thanks,
Paul

[lmoore]

Ideally, you would use a system with at least three internal interfaces.

The management interface should be on an isolated network which is in a different Broadcast Domain to your LAN, and it should never be included in the bridge.

OPNsense has a document how to set up a transparent firewall for IPS - https://docs.opnsense.org/manual/how-tos/transparent_bridge.html

I have a test system where I've installed OPNsense using the serial image, and it has a number of snapshots containing various configurations.

When I set up a new configuration, I'll create a new snapshot and use it. In the new snapshot a factory reset is performed so as to have a fresh configuration.

Include are the steps I use - it may help you. They should also work when performing a factory reset using a VGA console.

N.B: You may be able to apply the same settings when performing a new installation.

Code Select Expand

Configuration Information.

Interface assignments:

    em0     -> [MGMT]
    igb0    -> [WAN]
    igb1    -> [LAN]

Management IP address: 10.200.128.2/24
Management Gateway address: 10.200.128.1
Internal DNS server: 10.199.201.254

Configuration steps to prepare a system as a Transparent Firewall using the Serial console.

Perform a Factory Reset of OPNsense.

 - Connect a computer to the serial port on the OPNsense device using a baud rate of 115200
 
 - Power on OPNsense device

Ignore configuration importer

When message appears regarding interface assignment options, press a key when prompted.

 - Do you want to configure LAGGs now? [y/N]: <Enter>

 - Do you want to configure VLANs now? [y/N]: <Enter>

The list of available interfaces.

    Valid interfaces are:

    igb0             b4:96:91:8c:a0:f8 Intel(R) I350 (Copper)
    igb1             b4:96:91:8c:a0:f9 Intel(R) I350 (Copper)
    igb2             b4:96:91:8c:a0:fa Intel(R) I350 (Copper)
    igb3             b4:96:91:8c:a0:fb Intel(R) I350 (Copper)
    em0              48:4d:7e:ee:1b:4e Intel(R) I219-LM SPT(5)

 - Enter the WAN interface name or 'a' for auto-detection: <Enter>

 - Enter the LAN interface name or 'a' for auto-detection
   NOTE: this enables full Firewalling/NAT mode.
   (or nothing if finished): <Enter>

 - Enter the Optional interface 1 name or 'a' for auto-detection
   (or nothing if finished): em0

 - Enter the Optional interface 2 name or 'a' for auto-detection
   (or nothing if finished): igb0

 - Enter the Optional interface 3 name or 'a' for auto-detection
   (or nothing if finished): igb1

 - Enter the Optional interface 4 name or 'a' for auto-detection
   (or nothing if finished): <Enter>

    The interfaces will be assigned as follows:

    OPT1 -> em0
    OPT2 -> igb0
    OPT3 -> igb1

 - Do you want to proceed? [y/N]: y

The OPNsense banner after completing the boot process.


    *** OPNsense.localdomain: OPNsense 26.7.3_11 (amd64) ***

     OPT1 (em0)      ->
     OPT2 (igb0)     ->
     OPT3 (igb1)     ->

     HTTPS: SHA256 6E C9 0B 92 1B AB C9 15 20 B1 D2 76 08 EF 80 98
                   C4 6F E0 91 4C 04 EE 05 FB FB 34 AA 49 F8 7F F2

    FreeBSD/amd64 (OPNsense.localdomain) (ttyu0)



    login:

Log in as root.

 - Select option 2 - Set interface IP address
 
 - Select 1 - OPT1 (em0)
 
 - Configure IPv4 address OPT1 interface via DHCP? [y/N] N

 - Enter the new OPT1 IPv4 address. Press <ENTER> for none:
   > 10.200.128.2

 - Enter the new OPT1 IPv4 subnet bit count (1 to 32):
   > 24

 - For a WAN, enter the new OPT1 IPv4 upstream gateway address.

 - For a LAN, press <ENTER> for none:
   > 10.200.128.1

 - Do you want to use the gateway as the IPv4 name server, too? [Y/n] n

 - Enter the IPv4 name server or press <ENTER> for none:
   > 10.199.201.254

 - Configure IPv6 address OPT1 interface via DHCP6? [y/N] <Enter>

 - Enter the new OPT1 IPv6 address. Press <ENTER> for none:
   > <Enter>

 - Do you want to enable the DHCP server on OPT1? [y/N] <Enter>

 - Do you want to change the web GUI protocol from HTTPS to HTTP? [y/N] <Enter>

 - Do you want to generate a new self-signed web GUI certificate? [y/N] <Enter>

 - Restore web GUI access defaults? [y/N] Y

The OPNsense banner after IP assignment.


    *** OPNsense.localdomain: OPNsense 26.7.3_11 (amd64) ***

     OPT1 (em0)      -> v4: 10.200.128.2/24
     OPT2 (igb0)     ->
     OPT3 (igb1)     ->

     HTTPS: SHA256 6E C9 0B 92 1B AB C9 15 20 B1 D2 76 08 EF 80 98
                   C4 6F E0 91 4C 04 EE 05 FB FB 34 AA 49 F8 7F F2

      0) Logout                              7) Ping host
      1) Assign interfaces                   8) Shell
      2) Set interface IP address            9) pfTop
      3) Reset the root password            10) Firewall log
      4) Reset to factory defaults          11) Reload all services
      5) Power off system                   12) Update from console
      6) Reboot system                      13) Restore a backup

    Enter an option:

 - Select option 0 - Logout

Log in to the WebGUI.

 - Interfaces -> Neighbors -> Automatic Discovery
    - Enabled: untick
    - Click 'Apply'

Update descriptions for OPT1, OPT2 & OPT3.

 - Interfaces -> [OPT1]
    - Description: MGMT
    - Click 'Save'

 - Interfaces -> [OPT2]
    - Description: WAN
    - Click 'Save'

 - Interfaces -> [OPT3]
    - Description: LAN
    - Click 'Save'
    - Click 'Apply changes'

Add and assign the Bridge interface.

 - Interfaces -> Devices -> Bridge
    - Add
    - Member interfaces: WAN, LAN
    - Click 'Save'
    - Click 'Apply'

 - Interfaces -> Assignments
    - Add
    - Description: BRIDGE
    - Select device from drop-down list: bridge0 ()
    - Click 'Save'
    - Click 'Apply'

 - Interfaces -> [BRIDGE}
    - Enable: tick option
    - IPv4 Configuration Type: None
    - IPV6 Configuration Type: None
    - Click 'Save'
    - Click 'Apply changes'

Disable firewall Source NAT.

 - Firewall -> NAT -> Source NAT
    - Mode: Disable Source NAT rule generation
        - Click 'Apply'

Configure Unbound to forward queries to the internal DNS server.

 - Services -> Unbound -> Query Forwarding
    - Use System Nameservers: tick
    - Click 'Apply'
At this point you will need to configure your system according to how you will use your Transparent Firewall.

HTH. :)

[psehorne]

Imore, thank you.  I'll give this a try.

[psehorne]

Imore, that worked!  Thank you.
I think the key was putting the MGMT on a different network.

[lmoore]

The catch is the auto-generated anti-lockout rules get assigned to the LAN interface when you first set up OPNsense. Changing them afterwards isn't straight forward.

I've yet to refine the configuration process to avoid the 'Start Initial Configuration' page with this method. If you receive this page when you log in to the WebGUI, ignore it as proceeding with it will break your configuration.

[bimbar]

I might add that usage as transparent filtering bridge is a niche application and not generally well supported or documented.

[psehorne]

I might add that usage as transparent filtering bridge is a niche application and not generally well supported or documented.

Yes, I am discovering that to be true

[bimbar]

There are however a few popular youtube videos pushing that scenario, which I disapprove ;) .