Let's Bridge These Ports - OPNsense

A viewer asked me to do a quick video for him, on how to bridge the extra ports you have in your firewall, I too had problems with this. In this video i show you actually how easy it is !
I forgot to mention in the video to System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1
Questions ? jason @ jasonslab . ca
#opnsense
‪@TangDynasty1983‬

[@JasonsLabVideos]

I forgot to mention in the video to System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1

[@kenmorris2858]

Excellent video, many thanks from Nova Scotia....

[@Kynsuji]

Your tip on how to bridge in OPNsense is perfect. Thank you for the video and instructions!

[@Kushari]

Just came back to say thanks. This helped me yesterday. Was able to set up all the ports on my Qotom pc as lan ports.

[@JasonsLabVideos]

Glad it helped !! Cheers

[@Kushari]

@@JasonsLabVideos yeah! The whole buy a switch when you already have ports doesn’t make sense to me.

[@JasonsLabVideos]

@@Kushari Depends if you need Vlans or Poe :)

[@ryanvemulapalli]

Thank you so much for this video! Helped me so much setting up my firewall. Straight forward and to the point, thanks!

[@joecook4451]

very helpful tips on setting up a bridge without getting locked out!

[@Namegoeshere-op9hg]

Dude, thank you for this!

[@theWSt]

This video is very helpful and saved me from a lot of headaches, thx!

[@XYZQ578]

Great tutorial Jason. Kudos to You !

[@REALnTOXIC]

Excellent. This config and use case I was searching a tutorial about.

[@donaldhunt4]

Great video, love the whole thing. I look forward to watching more of your stuff.

[@JasonsLabVideos]

Thank you sir, thanks for watching !

[@TheAntonymer]

Super handy! Thank you.

[@Music47832]

You saved my day. Thank bro.!!!

[@bjornreinecke5036]

thank you very much 😀👍

[@GlennPerdicaro]

thnx alot for your guide!! very usefull for me ;)

[@miguelaustralia3473]

Thanks mate, it worked fine for me.

[@Lilruff]

Thank you for this video

[@hakunamatata324]

This was beautiful to watch. Liked and subscribed.

[@JasonsLabVideos]

Thanks sir !

[@rickevans7941]

Thanks dude

[@werner.m7200]

great video! uou make is so easy ;)

[@QuikTechSolutions]

Excellent video Jason! I appreciate your candor early on. I have been trying to get bitwarden self-hosted setup. I keep failing at it but am learning from the experience. I get it installed, I can create a Master PW, login, etc. I point the browser extension to the self-hosted server but keep getting a backend null error. I tried once using Synology Docker, and twice on an Ubuntu VM. I am determined to figure it out. So, I know exactly where you are coming from. Great job!

[@JasonsLabVideos]

We all learn differently! Not everyone wins on the first attempt :) but we learn and that's key :)

[@hjm229]

Thanks

[@liojoreck7522]

thx for the vid

[@mrsmith6316]

Brilliantly explained Jason, well done. I've been head scratching for days now trying this. I'm swapping an OpenWRT 3200 with VLANS's out for this as I now want to compare performance, so want to mirror the setups. My OPNsense box is an APU4. Nice box, just remember to get the correct OPNsense image for installation, and it works MUCH better during installation if you use putty than console on Linux. I previously had it all working but as the setup is so stable, I forgot how I set up the OPNsense box last time! [write the fine manual this time ;-) ]

[@JasonsLabVideos]

If ya have questions just ask, always willing to help people :)

[@jeytis72]

Very informative. Do you have also a video about firewall rules and DNS override? Something that dives a bit deeper into them. I had some problems at set them up properly. Thanks

[@JasonsLabVideos]

Soon :)

[@rlwoodlief]

Harass, harass! Great video Jason. Also I enjoy our email exchanges.

[@JasonsLabVideos]

OH MAN you are a blast to chatt with! We should do a phone call one day :) Thanks for watching BTW

[@AdrianBadea]

Great stuff. I've been doing the same thing on box that I recently purchased from Aliexpress, to use it as my home firewall. The box itself has 4 ports 2.5Gb, one dedicated to WAN, one for LAN/MGMT and what about the other 2? So, I have been playing to basically create a switch and use it to connect to another switch down the line and one port for a server that I want to have full speed 2.5Gb as the port on my firewall has. I have to mention that my fibre connection is 3Gb.

[@starfoxBR77]

Hey Jason. Thank you very much! Brand new subscriber here. I would like to share that after I successfully followed your steps on this video, I realized I could not reach or ping any IP directly in my LAN. No DCHP leases for any other device on a switch etc. So I found out that in order to get the bridge fully working for Firewall Rules, we need to disable filtering for the Bridge members interfaces and enable it for the Bridge interface itself: System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1 (inverting the default setting). Hope it helps!

[@NihalVishvamitra]

Thank you. I was having the same issues and this worked for me. Are there any security considerations when doing this?

[@LucidEnemy]

I have been pulling my hair out for 3 days trying to figure out the right firewall rules I followed this video to enable the bridge didnt even think to do this lol thank you kind sir!

[@starfoxBR77]

@@LucidEnemy Happy to help!!

[@starfoxBR77]

@@NihalVishvamitra Happy to help. No security implications unless the device is phisicaly accessed by unknown people in a easy to access place :-)

[@ProctoLogic]

Worked. Thanks

[@ShinyTechThings]

That's some beefy hardware, how much stuff can you run on it for rules before you take a performance hit? I wonder if that would even be possible on that hardware. When I've built appliances like this it's usually a low power Celeron based unit so it's limited but fine for a basic solid firewall.

[@MarekCezaryWojtaszek]

Great job, Jason! This is exactly what I was looking for! Even the port count matches my case :)

[@JasonsLabVideos]

Thanks sir, glad you watched and enjoyed !! More videos coming soon !

[@MarekCezaryWojtaszek]

@@JasonsLabVideos Thanks! Added the channel to my subscriptions :) As I have you here... Something is not right... There must be something more to the bridge configuration. After following your instruction I was able to connect devices to any of the 4 free bridged LAN ports but it worked perfectly only when I connected just one single device. Once I connected any additional device at the same time -- my whole home network was like freaking out immediately: I was losing connectivity to random devices or event the whole parts of my network. It behaved like an IP conflict or something of that sort. I spent like 3-4 hours on trying to figure out what was wrong and I ended up with coming back to using just one LAN port again and using an external switch :( Help... :)

[@JasonsLabVideos]

@@MarekCezaryWojtaszek Did you apply the 2 system tunables ?

[@MarekCezaryWojtaszek]

@@JasonsLabVideos Nope. Did I miss something from the video?

[@MarekCezaryWojtaszek]

After some further experiments it turned out that one of my switches may have generated some conflicts which randomly caused various issues in my network. It is a managed TP-LINK switch and I may have over-managed it :). I experienced issues even after restoring the pre-bridge OPNsense configuration from backup. After hard resetting the faulty switch all issues stopped immediately. I will watch it further and if it continues working flawlessly I will try bridging the ports again. Will let you know. Thanks!!

[@glitch0156]

Thanks for the tutorial. You may also need to configure the firewall rules for each bridged ports if you have multiple subnets & existing firewall policies. You might also be able to keep the port assignments to the default if you copy all the fw rules, dhcp, etc rules to the bridge interface.

[@JasonsLabVideos]

and enable system tunables.

[@glitch0156]

@@JasonsLabVideos Yes, if you don't want to configure each firewall rule for each port, enable Tunables per the documentation so that the applied fw rules applies to all bridge ports.

[@ProctoLogic]

@@glitch0156 System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1

[@ProctoLogic]

@@JasonsLabVideos You forgot to mention in the video to System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1

[@jfkastner]

Impressive little box with a 6 core i5! Maybe I'll try OPNsense, I'm just not a big BSD fan ...

[@TheInspiration152]

Thsnk you Sir. It help me a lot... Do you have video on how to create vlan using the lan interface.... ❤❤❤

[@JasonsLabVideos]

I sure do, its on my channel for a Opnsense full setup i believe.

[@SDWeatherCam]

Will this bridge setup work virtualized on ESXI? I’ve been trying to get it to work, but no luck.

[@thegeekno72]

My brain is spinning backwards and sideways trying to understand why, not only it didn't work on my end, but why did it make me lose internet on the one interface that was working...

[@TangDynasty1983]

You are awesome! Is it possible if you can go one step further and show us how we configure those bridged ports as Trunk ports carrying same vlan tags on each one?

[@JasonsLabVideos]

Next video :) yup ! It's coming

[@raventai]

Still coming? This is exactly what I need, I have a 4 port intel nic in a T730 thin client running opnsense I would like to play with vlans but all my switches are passive/dumb. If I could create VLANs right at the router, my network could progress.

[@maciekczl]

unfortunately, in the case of virtualizing pfsense on esxi, I am unable to activate the rest of the LAN ports in this way, although each port in esxi has its own vswitch.. after changing the Lan interface from port to bridge, I lose access to the GUI even after switching the cable to one of the ports belonging to bridge

[@Almightyrastus]

Nice, even I managed to understand this one and I am still very much new to this style of networking. I have a question if I may, I have in the works a very similar type small PC that I shall be using as my OPNSense box, a Fujitsu S920 with a 4 port gigabit card in much like this. I shall be using also be using the onboard port for the wan connection and my plan is to use the 4 port card to feed out to switches around the house where I need to break out multiple connections. My question being that I assume that I will have to go through this process to set those card ports up to be active in this way? I won't be plugging any end-hardware directly to the OPNsense box.

[@JasonsLabVideos]

yup

[@SeanAnthony]

Hey Jason can you make a video on how to setup a LAGG? instead of bridging the ports, can you create a LAGG? Can the LAGG be assigned to your Default LAN?

[@JasonsLabVideos]

Yes, thats my next plan to learn how to do :) I'll have to muck it up 20x before i get it right BUT thats the whole point of my lab and learning !! Thanks for the suggestion Sean :)

[@SeanAnthony]

@@JasonsLabVideos Thank you for your hard work. I look forward to that tutorial for OPNsense. Thanks again!

[@bigsnyder01]

Thank you for the tutorial! Curious as to why bridging is not recommended on various channels and forums? Supposedly there is a performance penalty, if so how much? What would be the recommended alternative if you want to utilize the additional ports on the same local network? Btw, I am using unmanaged switches.

[@JasonsLabVideos]

My recommendation is to upgrade to managed switchs. I haven't noticed any issued with Bridged ports or using them for different subnets though.

[@MrPir84free]

When I tried this, if I remember correctly, I could only attach VLANs to the NIC's themselves but could not select the bridge itself. In OpenWRT, you can. In OpnSense, not so much. Far easier to switch over to managed switches and trunk everything you need over one cable. The best use case that I've found is to use one of the remaining ports as backup access into the router. There is a completely different mentality and functionality between Opnsense and OpenWRT.

[@charliecooper5457]

Thanks - I'm close I think - I tried this from a fresh install after I worked out how to get internet working but only via 1 of the LAN ports on my router (mini pc). My PC has 3 ethernet ports but when I plug my PC into the other port in your step @5:50 I just loose connection and even swapping the cable into the next port doesn't sovle it. I have to be close but are there other ideas? Does this guide assume I've setup other aspects of the configuration? At the moment I have static IP on the LAN and that's about it which gives me internet to one computer :/

[@JasonsLabVideos]

on the lan you don't have dhcp ?

[@DOGEME]

I'm in the same boat with my device (cxa-770). I believe it's an driver issue. NIC drivers not present when installing FreeBSD. Unfortinitual I'm unsure how to fix that as I'm new to FreeBSD and its commands. Hopefully we come across some kind of solution from other users.

[@khalidshaikh2380]

Hi Jason, I am curious about Box setup, I have same box and I bought Mini PCI-E to PCI-E 16 but it don't fit.

[@JasonsLabVideos]

Email me, I'll assist.

[@danielorneling2831]

What hardware is it that you use for this video? Im curious about both the Leonovo PC and the "box" you showed with 4 ethernet ports. Thanks!

[@JasonsLabVideos]

Morning there are 2 boxes one is a M720Q with a Celeron G4900T and a quad port intel nic, the other is a M920q i5 8500t with a quad port intel nic. You can buy the PCIE 4 & 8x & 16x cards for inside the units and then throw in a low profile nic :) works really really good too !

[@danielorneling2831]

@@JasonsLabVideos Thanks! WIll look more into it to it to get the best FW possible :)

[@JasonsLabVideos]

Any questions, just shoot me an email :) @@danielorneling2831

[@danielorneling2831]

@@JasonsLabVideos oh btw, were both Lenovo PCs dual nic by default or have you added the extra ports yourself through PCIe?

[@MrPir84free]

Did you ever get your bridge to work with VLANs ? I found it simpler to go back to trunking everything off from one port to a switch and going from there.

[@JasonsLabVideos]

Yup, its just s simple thing in system tunables that needs to be checked.

[@Liberty-Grunt]

Exceptional and exceptionally brief video tutorial! Nevertheless, I was under the assumption that I could set up independent physical networks for each LAN port on my Qotom Mini PC Q750G5, and am running into trouble. Port0=WAN and Port1=LAN1 are working swimmingly. OPT2-4 is dead in the proverbial water. Would love your thoughts.

[@JasonsLabVideos]

You can setup networks per port, you have to turn on the tuuneables. Send me an email and ill help ya.

[@Liberty-Grunt]

​@@JasonsLabVideos I think I figured it out: Assigned and enabled the LANPort2 (igc2) + assigned/applied an IPv4 range -> Rebooted -> Enabled DHCPv4 for LANPort2 -> Meandered over to Firewall Rules and noticed the same inbound-only rules for IPv4/6 automagically appeared (literally mirroring the rules assigned to LANPort1 (igc2) -> connected to my wireless router and behold, it worked! I appreciate you offering to give me a hand. If anything I outlined seems odd, strange, or wrong, please don't hesitate to let me know. :)

[@MrIous99]

Whats wrong with ...1.1? Feeling a bit on the spot here, since mine is at 0.1, which I assume is equally bad. Why though?

[@dzalejandro]

Hello Jason is the model of the expansion card with 4 nics that fits into that kind of system?

[@JasonsLabVideos]

Yup

[@dzalejandro]

@@JasonsLabVideos sorry didnt make the rquestion, is what is the model of the nic? and how do you install it

[@herrherrmann]

i love you

[@AdrianuX1985]

8:08.. Q: How much will the routing performance drop on this hardware when you turn on "Zenarmor"??

[@JasonsLabVideos]

On this i5 6 core ? Hardly any. I have a build video coming soon and will be using zenarmor

[@AdrianuX1985]

@@JasonsLabVideos Will you do a performance test on this hardware (with zenarmor), but with several clients? (a real-life use scenario)

[@JasonsLabVideos]

@@AdrianuX1985 yup, sure will !

[@Seansmit23]

I hope someone can help me.. I have been trying to get this working for days and found this video but I still can not get it working. I am only needing to use an exta 1 nic. I have my WAN, LAN set up and working. I then have a 3rd port id like a wifi AP to be connected to so I can get wifi access via opnsense as well. I add the OPT1, Enable it then make a bridge with OPT1 in it. I then set the LAN to the bridge just made and then swap the lan cable to the 3rd nic assigned to OPT1 but i can never get an IP via DHCP and setting it my self does not help either. I am running this in a Hyper-V on Windows 11 so this may be getting in the way somehow? I could test that by trying it with opnsense installed directly onto the machine vs a VM but a VM is ultimately where i need it to be run any ideas ppl cus im stummed.

[@JasonsLabVideos]

Buy a mananged l2 switch, and vlan it. You can do all this with hyper v using vlans.

[@Seansmit23]

@@JasonsLabVideos Buying a switch is one of my next steps but I am trying to avoid that for now if I can. I have been trying to do this again with pfsense and opnsense installed directly and not via a VM. And now it wont detect my 2.5gb dual port nic... I need the realtek-re-kmod driver but it wont detect the card anymore even though it used to on a prevoius attempt at setting things up.. so I cant even try your method on bare metal unless I can get this nic to get detected. thanks

[@JasonsLabVideos]

@@Seansmit23 BUY the switch, make your life easier. Not Harder. P.s Opnsense and pfsense HATE realtek nic cards. Intel for sucsess.

[@ShinyTechThings]

First!

[@carpediem673]

Unfortunately this didn't work for me. Are these instructions specific to your device? I have a VNOPN Micro Firewall with four Intel nics. I was hoping to be able to make use of them all. Edit: Got it working following this video: kzbin.info/www/bejne/bWG7eKhrZdKKrNk It's for pfSense but the procedure is the same in OPNsense :)

[@pagefault404]

I'm trying to make a transparent bridge firewall, and I've followed four different guides that all say something different, which is frustrating enough, and now not even this video worked for me. I understand the concept and how you explained it, but once I set up the bridged adapter, it borks my connection to the web gui and locks me out (I stopped checking the disable anti admninistrator lockout while trying to reinstall on my second attempt. I am on my sixth attempt now.) What kills me about this, is that I can get a Cisco ASA up and properly configured in 2 hours with the little I remember from the classes I got in the Army and some googling, 100% in the command line. No ASDM. Yet this point n click tinker toy firewall BS is kicking the CRAP out of me. You need certs for Cisco! There are extremely hard classes for Cisco. I failed my CCNA twice and never went back, and yet I have more success with my ASA than with this. I'm ranting, but I am at my wits end. I am about ready to just drop it and install Windows or something else. I can be doing more productive things on memorial day than beating my face against a brick wall trying to get this gobshite to work.

[@JasonsLabVideos]

email me, see if i can assist

[@pagefault404]

@@JasonsLabVideos I never expected a response lol! (Just tried and failed with pfsense for a completely different reason FYI) I'll shoot you an email

[@alistairfreedom2456]

That didnt auth using a client cert

[@JasonsLabVideos]

What ?

[@DOGEME]

LOL... LOL Just bypass that part by clicking continue a couple times on the link in bottom of that page. ;)

[@ProctoLogic]

I did this and i have internet on all ports but i cant ping my computers or see network share. Edit. Found the fix here in comments section. System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1