Transparent Bridge Multiple VLAN

adam:ONE®
,
1

I have moved my core router to a Fortigate and to keep the Adam:ONE I have a transparent bridge setup. I have followed the transparent bridge documentation with the difference that my pfSense webconfig is on a management interface, so access to the pfSense is not on the bridge interface. I have multiple vlan traffic passing through the bridge between a trunk port on a Juniper ex3000 and the Fortigate, the native vlan on the trunk is a blackhole. I will also be passing through ipv6 traffic.

  1. Traffic does not pass through the bridge when it’s a trunk port, it did in testing with only one subnet .
  2. ipv6 does not work as well and this did not work when it was a simple flat network for testing,.
2

Hey @bornpilot thanks for the feedback. Did you get VLANs to pass the bridge without using a trunk port?
I’m just not sure from your post if you did find a way to get it working, or if you didn’t get VLANs to work at all.

3

I was not attempting to pass VLAN traffic without using a trunk. When configured as an access port, untagged traffic passed through the bridge, but it was not being filtered.

Since my original post, I have been able to pass IPV4, IPv6 and VLAN-tagged traffic by configuring the pfSense interfaces connected to the bridge as trunk ports. I accomplished this by adjusting the firewall rules created by Adam:ONE and removing the “macro” values from the source fields. Reviewing the logs I could see the traffic was being denied by the default deny rule. Removing the OPT1 Subnet from the source by setting the value to all allowed the traffic to pass.

At this point, the bridge successfully passes VLAN-tagged IPv4 and IPv6 traffic, but the filtering still does not appear to be working.

If I understand the process correctly Adam:One application within pfSense should intercept DNS traffic and redirect, so it should not really matter what my workstations DNS is configured too? On the upstream router (Fortigate) I don’t have anything blocking DNS for filtering applied.

4

There is a limitation with pfSense where you cannot hijack DNS. So you would have to probably create a rule on the firewall where it would block any DNS that is not going to the adam:ONE IP listening on the bridge interface.

5

but the filtering still does not appear to be working.

What information should I submit that might help diagnose why filtering is not working?

6

I’d recommend sending screenshots of your config to our support team. Include your firewall rules, bridge interface settings, and the DNS settings on your test device.