Let's Bridge These Ports - OPNsense 

I forgot to mention in the video to System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1

I've tried doing this from the documentation several times and missed that one crucial step. As soon as you said it in your video, the light bulb went on and 'click' :) Thanks for that.

You saved my day. Thank bro.!!!

Thank you for this video

That's some beefy hardware, how much stuff can you run on it for rules before you take a performance hit? I wonder if that would even be possible on that hardware. When I've built appliances like this it's usually a low power Celeron based unit so it's limited but fine for a basic solid firewall.

thank you so much man that help out 🙂

I hope someone can help me.. I have been trying to get this working for days and found this video but I still can not get it working. I am only needing to use an exta 1 nic. I have my WAN, LAN set up and working. I then have a 3rd port id like a wifi AP to be connected to so I can get wifi access via opnsense as well. I add the OPT1, Enable it then make a bridge with OPT1 in it. I then set the LAN to the bridge just made and then swap the lan cable to the 3rd nic assigned to OPT1 but i can never get an IP via DHCP and setting it my self does not help either. I am running this in a Hyper-V on Windows 11 so this may be getting in the way somehow? I could test that by trying it with opnsense installed directly onto the machine vs a VM but a VM is ultimately where i need it to be run any ideas ppl cus im stummed.

Great stuff. I've been doing the same thing on box that I recently purchased from Aliexpress, to use it as my home firewall. The box itself has 4 ports 2.5Gb, one dedicated to WAN, one for LAN/MGMT and what about the other 2? So, I have been playing to basically create a switch and use it to connect to another switch down the line and one port for a server that I want to have full speed 2.5Gb as the port on my firewall has. I have to mention that my fibre connection is 3Gb.

thnx alot for your guide!! very usefull for me ;)

First!

Hey Jason, I just did the configuration and wanted to say thank you! This was driving me mad 😂 I however ran into an odd issue, not sure if you experienced the same thing. So I have my main LAN on OPT0 and then I have a separate device on OPT1 they are under the same bridge assigned to LAN but for some reason devices on OPT1 can't talk or receive comms from OPT0 yet both of them can breakout to the internet. Do you know if this is a configuration error or maybe we need some manual firewall or NAT rules?

OMG, I spent 3 days trying to find your video solution. Everywhere on the internet, people say that you can only use one port for WAN and one for LAN. They also claim that a switch is faster for making LAN connections. Could you test this theory and compare it with this small PC using a bridge connection?

Nice, even I managed to understand this one and I am still very much new to this style of networking. I have a question if I may, I have in the works a very similar type small PC that I shall be using as my OPNSense box, a Fujitsu S920 with a 4 port gigabit card in much like this. I shall be using also be using the onboard port for the wan connection and my plan is to use the 4 port card to feed out to switches around the house where I need to break out multiple connections. My question being that I assume that I will have to go through this process to set those card ports up to be active in this way? I won't be plugging any end-hardware directly to the OPNsense box.

Hey Jason can you make a video on how to setup a LAGG? instead of bridging the ports, can you create a LAGG? Can the LAGG be assigned to your Default LAN?

Excellent video, many thanks from Nova Scotia....

Great tutorial Jason. Kudos to You !

What hardware is it that you use for this video? Im curious about both the Leonovo PC and the "box" you showed with 4 ethernet ports. Thanks!

Excellent video Jason! I appreciate your candor early on. I have been trying to get bitwarden self-hosted setup. I keep failing at it but am learning from the experience. I get it installed, I can create a Master PW, login, etc. I point the browser extension to the self-hosted server but keep getting a backend null error. I tried once using Synology Docker, and twice on an Ubuntu VM. I am determined to figure it out. So, I know exactly where you are coming from. Great job!

I did this and i have internet on all ports but i cant ping my computers or see network share. Edit. Found the fix here in comments section. System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1

Thank you so much for this video! Helped me so much setting up my firewall. Straight forward and to the point, thanks!

My brain is spinning backwards and sideways trying to understand why, not only it didn't work on my end, but why did it make me lose internet on the one interface that was working...

Excellent. This config and use case I was searching a tutorial about.

Hello.... is it possible that in transparent mode you can't use the ssl web proxy?. I can't make the transparent web proxy work for me with this configuration. Bye

Dude, thank you for this!

Your tip on how to bridge in OPNsense is perfect. Thank you for the video and instructions!

thank you very much 😀👍

good clear video! Thank you! What adapter do you need to get a four-port Ethernet adapter inside the mini lenovo?

Hey Jason. Thank you very much! Brand new subscriber here. I would like to share that after I successfully followed your steps on this video, I realized I could not reach or ping any IP directly in my LAN. No DCHP leases for any other device on a switch etc. So I found out that in order to get the bridge fully working for Firewall Rules, we need to disable filtering for the Bridge members interfaces and enable it for the Bridge interface itself: System ‣ Settings ‣ Tunables and change "net.link.bridge.pfil_member" to 0 and "net.link.bridge.pfil_bridge" to 1 (inverting the default setting). Hope it helps!

Very informative. Do you have also a video about firewall rules and DNS override? Something that dives a bit deeper into them. I had some problems at set them up properly. Thanks

This video is very helpful and saved me from a lot of headaches, thx!

Hello Jason is the model of the expansion card with 4 nics that fits into that kind of system?

very helpful tips on setting up a bridge without getting locked out!

Just came back to say thanks. This helped me yesterday. Was able to set up all the ports on my Qotom pc as lan ports.

great video! uou make is so easy ;)

Unfortunately this didn't work for me. Are these instructions specific to your device? I have a VNOPN Micro Firewall with four Intel nics. I was hoping to be able to make use of them all. Edit: Got it working following this video: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-70XGu50mWvw.html It's for pfSense but the procedure is the same in OPNsense :)

Thsnk you Sir. It help me a lot... Do you have video on how to create vlan using the lan interface.... ❤❤❤

Whats wrong with ...1.1? Feeling a bit on the spot here, since mine is at 0.1, which I assume is equally bad. Why though?

Impressive little box with a 6 core i5! Maybe I'll try OPNsense, I'm just not a big BSD fan ...

Thanks mate, it worked fine for me.

Harass, harass! Great video Jason. Also I enjoy our email exchanges.

Thanks

Brilliantly explained Jason, well done. I've been head scratching for days now trying this. I'm swapping an OpenWRT 3200 with VLANS's out for this as I now want to compare performance, so want to mirror the setups. My OPNsense box is an APU4. Nice box, just remember to get the correct OPNsense image for installation, and it works MUCH better during installation if you use putty than console on Linux. I previously had it all working but as the setup is so stable, I forgot how I set up the OPNsense box last time! [write the fine manual this time ;-) ]

Will this bridge setup work virtualized on ESXI? I’ve been trying to get it to work, but no luck.

thx for the vid

You are awesome! Is it possible if you can go one step further and show us how we configure those bridged ports as Trunk ports carrying same vlan tags on each one?

Thanks dude

Saved me a lot of time!

Great video, love the whole thing. I look forward to watching more of your stuff.

Super handy! Thank you.

This was beautiful to watch. Liked and subscribed.

great video

Thanks - I'm close I think - I tried this from a fresh install after I worked out how to get internet working but only via 1 of the LAN ports on my router (mini pc). My PC has 3 ethernet ports but when I plug my PC into the other port in your step @5:50 I just loose connection and even swapping the cable into the next port doesn't sovle it. I have to be close but are there other ideas? Does this guide assume I've setup other aspects of the configuration? At the moment I have static IP on the LAN and that's about it which gives me internet to one computer :/

i love you

Thanks for the tutorial. You may also need to configure the firewall rules for each bridged ports if you have multiple subnets & existing firewall policies. You might also be able to keep the port assignments to the default if you copy all the fw rules, dhcp, etc rules to the bridge interface.

unfortunately, in the case of virtualizing pfsense on esxi, I am unable to activate the rest of the LAN ports in this way, although each port in esxi has its own vswitch.. after changing the Lan interface from port to bridge, I lose access to the GUI even after switching the cable to one of the ports belonging to bridge

Great job, Jason! This is exactly what I was looking for! Even the port count matches my case :)

Hi Jason, I am curious about Box setup, I have same box and I bought Mini PCI-E to PCI-E 16 but it don't fit.

Did you ever get your bridge to work with VLANs ? I found it simpler to go back to trunking everything off from one port to a switch and going from there.

Exceptional and exceptionally brief video tutorial! Nevertheless, I was under the assumption that I could set up independent physical networks for each LAN port on my Qotom Mini PC Q750G5, and am running into trouble. Port0=WAN and Port1=LAN1 are working swimmingly. OPT2-4 is dead in the proverbial water. Would love your thoughts.

Thank you for the tutorial! Curious as to why bridging is not recommended on various channels and forums? Supposedly there is a performance penalty, if so how much? What would be the recommended alternative if you want to utilize the additional ports on the same local network? Btw, I am using unmanaged switches.

8:08.. Q: How much will the routing performance drop on this hardware when you turn on "Zenarmor"??

That didnt auth using a client cert

I'm trying to make a transparent bridge firewall, and I've followed four different guides that all say something different, which is frustrating enough, and now not even this video worked for me. I understand the concept and how you explained it, but once I set up the bridged adapter, it borks my connection to the web gui and locks me out (I stopped checking the disable anti admninistrator lockout while trying to reinstall on my second attempt. I am on my sixth attempt now.) What kills me about this, is that I can get a Cisco ASA up and properly configured in 2 hours with the little I remember from the classes I got in the Army and some googling, 100% in the command line. No ASDM. Yet this point n click tinker toy firewall BS is kicking the CRAP out of me. You need certs for Cisco! There are extremely hard classes for Cisco. I failed my CCNA twice and never went back, and yet I have more success with my ASA than with this. I'm ranting, but I am at my wits end. I am about ready to just drop it and install Windows or something else. I can be doing more productive things on memorial day than beating my face against a brick wall trying to get this gobshite to work.