5.2 Bridging issue

Aaron D. Gifford agifford at infowest.com
Thu Feb 12 02:56:57 PST 2004


I've got a bridge(4) issue on a BSD 5.2.1 box.  The bridging box has three ethernet interfaces, two bridged together in a single cluster, and one connected to the internet.  The box acts as a bridge for the two network segments, and as a router to the Internet (it's the default gateway).  The problem is, only one of the bridged segments can communicate with the BSD box directly (and thus the Internet), even though the two segments can talk to each other just fine.


First, let me clue you in on my network set-up:

FreeBSD 5.2 Box with 3 ethernet interfaces, em0, rl0, and rl1:

[FreeBSD Box]
  |   |   |
 rl0 rl1 em0
  |   |   |
  |   |   +---To-Internal-Network-Segment-#1...
  |   |
  |   +---To-Internal-Network-Segment-#2..

Interfaces rl1 and em0 are bridged:


Since they ARE bridged and so are "on the same subnet", only em0 has
an IP address:

  ifconfig em0 inet

I don't see how or why one would need or could assign an IP on the
same subnet to the other interface, rl1, unless it was handled like
many alias addresses, as a /32 host address.

Interface rl0 is the link to the Internet.

Bridging for the most part seems to be working.  Hosts on segment #1
(via em0) are visible to hosts on segment #2 (connected via rl1).  They
can ping each other, get ARP address resolution, and pass IP traffic.

All hosts use as their default gateway to the Internet.

Hosts on segment #1 can reach the Internet just fine.


Hosts on segment #2 cannot seem to be able to communicate with the
bridinging/routing FreeBSD box's own IP addresses, and since it is the
default gateway, in turn they cannot reach the Internet.  No layer 2
traffic (ARP) reaches the FreeBSD box directly (the ARP table shows
"incomplete" for all segment #2 addresses, even though ARP packets
DO reach segment #1 just fine, passing transparently through the
FreeBSD box.  The BSD box just can't see stuff addressed directly to it.

This is NOT a firewalling or NAT issue.  This is exclusively a bridging
issue.  Firewalling/NAT occurse elsewhere.

So since I'm a FreeBSD bridge(4) newbie, after scouring the man page,
reading the Handbook's information, searching various mailing list archives,
I can't find anything useful that tells me if bridge's bdg_forward() knows
how to handle traffic like this.  Apparently it doesn't.

So bridging is just fine if you want your BSD box hidden, transparent,
invisible.  But if you want it visible so it can act as a default gateway
to all segments of a subnet that are bridged together, HOW DOES ONE DO IT?

I can't ifconfig the rl1 interface with an IP on the same subnet unless it's
a /32, and that accomplishes nothing (the IP packets are addressed to the
IP address assigned to em0).  Bridging SHOULD just bridge, so traffic to
the BSD box's em0 IP should come in on rl1 and be processed by the host.

Somehow the bridging code knows the MAC addresses on the segment #2 side of
things (rl1), since it passes traffic between the two segments just fine.
But the kernel's ARP table is totally ignorant.  It can't find those hosts.


Thanks in advance for all help, pointers, etc.  If there's not a way to do
this, then this sounds like an issue that should be added to the BUGS section
of the bridge(4) man page.

Aaron out.

More information about the freebsd-ipfw mailing list