I used a dual PII/400 system with 2 Planet-ENW-9607 /sk(4)/ NICs and the machine was running DragonflyBSD 1.6.1.
## Setting up bridging
-To enable bridging and PF support on DragonFly you have two options: load the required kernel modules or compile them directly into the kernel. I chose the latter, because ALTQ support ha to be compiled into the kernel anyway in order to use traffic shaping (and I had to recompile for SMP as well :P). Here is my kernel config (only the parts that differ from GENERIC. Note that):
+To enable bridging and PF support on DragonFly you have two options: load the required kernel modules or compile them directly into the kernel. I chose the latter, because ALTQ support ha to be compiled into the kernel anyway in order to use traffic shaping (and I had to recompile for SMP as well :P). Here is my kernel config (only the parts that differ from GENERIC.):
machine i386
device pflog
# Symmetric Multiprocessing support
options SMP # Symmetric MultiProcessor Kernel
-options APIC_IO # Symmetric (APIC) I/O
+ options APIC_IO # Symmetric (APIC) I/O
After compiling, installing and rebooting I got bridging support. If you don't need/want to compile a kernel you can simply open (or create) ** /boot/loader.conf** and add these lines:
if_bridge_load="YES"
pf_load="YES"
-pflog_load="YES"
+ pflog_load="YES"
and if you don't want to reboot, you can load the modules realtime:
-
-
# kldload pf.ko
# kldload pflog.ko
-# kldload if_bridge.ko
+ # kldload if_bridge.ko
Well, we have bridging support now, we have to create an interface that represents the bridge and tell which NICs belong to it.
Edit /etc/rc.conf and include:
-
-
# Replace x.x.x.x with the desired IP.
ifconfig_sk0="inet x.x.x.x netmask 255.255.255.0"
ifconfig_sk1="up"
cloned_interfaces="bridge0"
ifconfig_bridge0="addm sk0 addm sk1 up"
pf_enable="YES"
-pflog_enable="YES"
+ pflog_enable="YES"
There is no need to have IPs in a bridge, but it is generally a good idea to have one interface with an IP address assigned, and if we would like to do filtering, it is necessary (well, for me at least. :P) It is also good because you can SSH into the machine or run it as a DHCP server, caching DNS server etc. as well (I run dhcpd on it, but won't cover that now, there are many great howto's out there). That's it, we have a running bridge with PF. Now let's go and configure filtering!
## Configuring the firewall