From owner-freebsd-questions@FreeBSD.ORG  Tue May 20 04:59:28 2014
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 89290733
 for <freebsd-questions@freebsd.org>; Tue, 20 May 2014 04:59:28 +0000 (UTC)
Received: from mail-qg0-x231.google.com (mail-qg0-x231.google.com
 [IPv6:2607:f8b0:400d:c04::231])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 4C1372B5E
 for <freebsd-questions@freebsd.org>; Tue, 20 May 2014 04:59:28 +0000 (UTC)
Received: by mail-qg0-f49.google.com with SMTP id a108so10279394qge.22
 for <freebsd-questions@freebsd.org>; Mon, 19 May 2014 21:59:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:sender:in-reply-to:references:date:message-id:subject
 :from:to:cc:content-type;
 bh=mO6kdxpLnuF2wNEZFmr22AkHpAMiUsDd2IiuhKD7fTI=;
 b=nq09pMX1ah/sK8Y7JpezzHNeg5F85/PCwJmY6DYHHQlJBteCr2wM4AryoPiT5a4TlU
 zwe7kz0pZhTiS5sjxSGPngdoDySjaZk4mXolQTyHmIWHk/I/XWmjgPGThrD43+ehPAFt
 t2gXpR5aSQMDH9rdpqDmL/MvlXgsUONnAYagUNOSs+ipXdq+WuJF+D5djOKMb9UvKOhS
 eDQMwQ7EO8bgxmKeJRMOnP5qnUDhDMzBcLE9BqfhlNcPrNui/t9hL7/Bk4hvD2TMhZFo
 0KhQF/d8gGDrRO5lDHSi2VfwdZR/h2BCaTBVKCUF13o9hMYFQ9G21vVEFZOeGGVvD4nD
 XNrQ==
MIME-Version: 1.0
X-Received: by 10.140.104.195 with SMTP id a61mr52657456qgf.102.1400561967300; 
 Mon, 19 May 2014 21:59:27 -0700 (PDT)
Sender: olivier2553@gmail.com
Received: by 10.140.102.136 with HTTP; Mon, 19 May 2014 21:59:27 -0700 (PDT)
In-Reply-To: <537ADD0E.5020803@paz.bz>
References: <537ADD0E.5020803@paz.bz>
Date: Tue, 20 May 2014 11:59:27 +0700
X-Google-Sender-Auth: PQJ40IQfKE8O2vFi6UiM56GYNCs
Message-ID: <CA+g+Bvge491nEYmkk8ZN99Ni1naSwLtt9aVV31sOkvi5O+7bCw@mail.gmail.com>
Subject: Re: transparent bridge ~ firewall
From: Olivier Nicole <olivier.nicole@cs.ait.ac.th>
To: Jim Pazarena <fquest@paz.bz>
Content-Type: text/plain; charset=UTF-8
Cc: "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 20 May 2014 04:59:28 -0000

Jim,

> Is it possible to configure fbsd so that it passes traffic thru two
> nics "transparently", (with a third nic installed as the management IP)?
>
> So that firewall rules can be applied between those two transparent
> nics? Don't want NAT, don't want routing. Just firewall "allow", "drop",
> or re-direct.
>
> I purchased a device which uses debian to do this. I would like to
> see if I can duplicate the functions on FreeBSD, my OS of choice.

I used to do that few years ago, using ip-firewall at that time
instead of ipfw, I can't remember the reason why, I think it was the
unavailability of layer 2 in IPFW at that time.

I have switched to zeroshell since because I needed captive portal too
and neither monowall nor pf sense did offer captive portal on bridged
intefaces when I did the change.

I am pretty sure that monowall and pfsense do offer bridged interfaces.

Best regards,

Olivier