How To PFSense Configure Network Interface As A Bridge / Network Switch
pfSense is an open source firewall/router computer software distribution based on FreeBSD. FreeBSD supports the bridge device. A bridge interface device can be created using pfSense. A bridge interface creates a logical link between two or more Ethernet interfaces or encapsulation interfaces. This link between the interfaces selectively forwards frames from each interface on the bridge to every other interface on the bridge. A bridge can serve several services, including isolation of traffic between sets of machines so that traffic local to one set of machines is not available on the wire of another set of machines, and it can act as a transparent filter for ip datagrams. This will work at layer 2 broadcast/collision domain.
Our sample setup
The setup is as follows:
+------------+ | NAS | 192.168.1.254 (lan) | Server 01 +------>--------+ +----------+ +------------+ | | | 192.168.1.10 lan -+ +- wan (rl0) ISP/Internet +---------+ | | Public IP: 18.104.22.168 | Desktop | | PFSense | +---------+------->----------+ | Host | 192.168.1.11 opt1-+ | +------------+ | | | HP | | | | Printer 01 +------------->opt2-+ | +------------+ +----------+ 192.168.1.12 Bridge0 includes following (note only lan interface needs an IP address) lan = vr0 = IP: 192.168.1.254 opt1 = vr1 = IP: none opt2 = vr2 = IP: none
I’m going to assume that you’ve already assigned and configured wan and lan interfaces.
Step #1: Assign opt1 and opt2 interfaces
First, assign and enable all the additional interfaces such as opt1, opt2 and so on by visiting Interfaces > (assign) option:
Click on each interface name such as opt1, opt2, opt3 and select “Enable Interface“. Make sure IPv4/IPv6 Configuration Type set to “None“. Finally click on the “Save” button:
Warning: Only one interface on a bridge should have an IP address. In this example, I’ve assigned IP address to lan interface (192.168.1.254). Do not add multiple IP addresses in the same subnet on different bridge member interfaces. Other interfaces on the bridge should remain with an IP type of None.
Step #2: Create a bridge interface
Visit Interfaces > (assign > Bridges option. Click on + symbol to add bridge0 and select member interfaces such as LAN, OPT1, OPT2 and so on. In this example, I’m only selecting LAN and OPT3 as member interfaces for bridge0:
My final bridge0 interface will look as follows:
Step #3: Adding a firewall rule
You need to add a firewall rule to allow traffic between each interface of the bridge. Click on Firewall > Rules > Select Lan interface. You need to select opt1, opt3 and so on. I suggest that you add a simple rule like “Default allow interface to any rule” i.e. set Protocol: any, Source: any, Destination: any > and click on the “Save” button:
Feel free to adjust firewall rules as per your needs and setup.
Step #4: Test it
Open the Terminal app and try to ping between nas server, printer and desktop using ping command:
ping 192.168.1.10 ping 192.168.1.254