The translation is temporarily closed for contributions due to maintenance, please come back later.

Source string Read only

(itstool) path: sect2/programlisting
Context English State
3Com and HomeConnect are registered trademarks of 3Com Corporation.
Intel, Celeron, Centrino, Core, EtherExpress, i386, i486, Itanium, Pentium, and Xeon are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.
Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this document, and the FreeBSD Project was aware of the trademark claim, the designations have been followed by the <quote>™</quote> or the <quote>®</quote> symbol.
$FreeBSD: head/en_US.ISO8859-1/articles/filtering-bridges/article.xml 53717 2019-12-29 14:13:50Z carlavilla $
Often it is useful to divide one physical network (like an Ethernet) into two separate segments without having to create subnets, and use a router to link them together. The device that connects the two networks in this way is called a bridge. A FreeBSD system with two network interfaces is enough in order to act as a bridge.
A bridge works by scanning the addresses of <acronym>MAC</acronym> level (Ethernet addresses) of the devices connected to each of its network interfaces and then forwarding the traffic between the two networks only if the source and the destination are on different segments. Under many points of view a bridge is similar to an Ethernet switch with only two ports.
Why use a filtering bridge?
More and more frequently, thanks to the lowering costs of broad band Internet connections (xDSL) and also because of the reduction of available IPv4 addresses, many companies are connected to the Internet 24 hours on 24 and with few (sometimes not even a power of 2) IP addresses. In these situations it is often desirable to have a firewall that filters incoming and outgoing traffic from and towards Internet, but a packet filtering solution based on router may not be applicable, either due to subnetting issues, the router is owned by the connectivity supplier (<acronym>ISP</acronym>), or because it does not support such functionalities. In these scenarios the use of a filtering bridge is highly advised.
A bridge-based firewall can be configured and inserted between the xDSL router and your Ethernet hub/switch without any IP numbering issues.
How to Install
Adding bridge functionalities to a FreeBSD system is not difficult. Since 4.5 release it is possible to load such functionalities as modules instead of having to rebuild the kernel, simplifying the procedure a great deal. In the following subsections I will explain both installation ways.
<emphasis>Do not</emphasis> follow both instructions: a procedure <emphasis>excludes</emphasis> the other one. Select the best choice according to your needs and abilities.
Before going on, be sure to have at least two Ethernet cards that support the promiscuous mode for both reception and transmission, since they must be able to send Ethernet packets with any address, not just their own. Moreover, to have a good throughput, the cards should be PCI bus mastering cards. The best choices are still the Intel <trademark>EtherExpress</trademark> Pro, followed by the <trademark class="registered">3Com</trademark> 3c9xx series. To simplify the firewall configuration it may be useful to have two cards of different manufacturers (using different drivers) in order to distinguish clearly which interface is connected to the router and which to the inner network.
Kernel Configuration
So you have decided to use the older but well tested installation method. To begin, you have to add the following rows to your kernel configuration file:
options BRIDGE
The first line is to compile the bridge support, the second one is the firewall and the third one is the logging functions of the firewall.
Now it is necessary to build and install the new kernel. You may find detailed instructions in the <link xlink:href="@@URL_RELPREFIX@@/doc/en_US.ISO8859-1/books/handbook/kernelconfig-building.html">Building and Installing a Custom Kernel</link> section of the FreeBSD Handbook.
Modules Loading
If you have chosen to use the new and simpler installation method, the only thing to do now is add the following row to <filename>/boot/loader.conf</filename>:
In this way, during the system startup, the <filename>bridge.ko</filename> module will be loaded together with the kernel. It is not required to add a similar row for the <filename>ipfw.ko</filename> module, since it will be loaded automatically after the execution of the steps in the following section.
Final Preparation
Before rebooting in order to load the new kernel or the required modules (according to the previously chosen installation method), you have to make some changes to the <filename>/etc/rc.conf</filename> configuration file. The default rule of the firewall is to reject all IP packets. Initially we will set up an <option>open</option> firewall, in order to verify its operation without any issue related to packet filtering (in case you are going to execute this procedure remotely, such configuration will avoid you to remain isolated from the network). Put these lines in <filename>/etc/rc.conf</filename>:
The first row will enable the firewall (and will load the module <filename>ipfw.ko</filename> if it is not compiled in the kernel), the second one to set up it in <option>open</option> mode (as explained in <filename>/etc/rc.firewall</filename>), the third one to not show rules loading and the fourth one to enable logging support.
About the configuration of the network interfaces, the most used way is to assign an IP to only one of the network cards, but the bridge will work equally even if both interfaces or none has a configured IP. In the last case (IP-less) the bridge machine will be still more hidden, as inaccessible from the network: to configure it, you have to login from console or through a third network interface separated from the bridge. Sometimes, during the system startup, some programs require network access, say for domain resolution: in this case it is necessary to assign an IP to the external interface (the one connected to Internet, where <acronym>DNS</acronym> server resides), since the bridge will be activated at the end of the startup procedure. It means that the <filename>fxp0</filename> interface (in our case) must be mentioned in the ifconfig section of the <filename>/etc/rc.conf</filename> file, while the <filename>xl0</filename> is not. Assigning an IP to both the network cards does not make much sense, unless, during the start procedure, applications should access to services on both Ethernet segments.
There is another important thing to know. When running IP over Ethernet, there are actually two Ethernet protocols in use: one is IP, the other is <acronym>ARP</acronym>. <acronym>ARP</acronym> does the conversion of the IP address of a host into its Ethernet address (<acronym>MAC</acronym> layer). In order to allow the communication between two hosts separated by the bridge, it is necessary that the bridge will forward <acronym>ARP</acronym> packets. Such protocol is not included in the IP layer, since it exists only with IP over Ethernet. The FreeBSD firewall filters exclusively on the IP layer and therefore all non-IP packets (<acronym>ARP</acronym> included) will be forwarded without being filtered, even if the firewall is configured to not permit anything.
Now it is time to reboot the system and use it as before: there will be some new messages about the bridge and the firewall, but the bridge will not be activated and the firewall, being in <option>open</option> mode, will not avoid any operations.
If there are any problems, you should sort them out now before proceeding.
Enabling the Bridge


No matching activity found.

Browse all component changes

Things to check

Multiple failing checks

Following checks are failing:
Unchanged translation: Portuguese (Brazil), Spanish


Source information

Source string comment
(itstool) path: sect2/programlisting
no-wrap, read-only
Source string location
String age
a year ago
Source string age
a year ago
Translation file
articles/filtering-bridges.pot, string 21