I am using FreeBSD 11.1-RELEASE. I setup bridge0 to bridge two interfaces. I want to only pass VLANs 40-90 on this bridge. How can I do this?

I am looking into using pf, but I would think the network stack would already come with the ability to decide what VLAN tags are acceptable, just like in Cisco switches how you configure the allowed vlan list on the trunk.

  • 2
    Look at ebtables or bridge-nf. – dirkt Aug 13 '17 at 5:29
  • I'm trying to stay within the base system. I might just try bridging only the vlans and not the entire parent interface. – Greg Schmit Aug 13 '17 at 15:12

If I understand you correctly you probably do not want to do it like that. Rather than bridging the interfaces I would bridge the vlan interfaces. You do not show what you have actually done - so I might be wrong. But it should be possible within the base system,

If you bridge with the parent interface then tagged packets would be untagged and retransmitted out the incoming interface.

This example shows how to bridge vlans (via rc.conf):

cloned_interfaces="bridge0 vlan40 vlan90"
ifconfig_vlan190="vlan 40 vlandev ixgbe1"
ifconfig_vlan590="vlan 90 vlandev ixgbe1"
ifconfig_bridge0="addm vlan40 addm vlan90"

Taken from the examples in a mail from Chris Cowart

This would probably be enough for your purpose. But if you want more filtering capabilities then the cloned interface names can be used within the pf firewall.

I do not know of a smart shorthand for a range but you can quickly create a number of vlan interfaces (maybe this is actually what you are asking):

vlans_ixgbe0="40 41 42 43 44 45"

The cloned interface will then be named "ixgbe0.40" (etc.) and can be referenced in rc.conf using "ifconfig_ixgbe0_40".

Shorthand form of the same example (not tested):

vlans_ixgbe1="40 90"
ifconfig_bridge0="addm ixgbe1.40 addm ixgbe1.90"

You could improve on your question if you add more information on what you want done - and show the configuration of bridge0. Also feel free to add errata to this answer (if usable) - and what config you end up using.

  • 1
    A good shorthand for a range is: vlans_ixgbe0="`seq 40 1 45`". – Greg Schmit Aug 16 '17 at 16:21
  • Maybe I wasn't clear. I don't want to bridge vlans 40 and 90 together. I want two interfaces to be bridged, but to only pass certain vlans on certain interfaces. So vlan 1000 won't work on the bridge, but vlan 41, 41, ... 90 would work. I'll let you know what I end up doing. – Greg Schmit Aug 16 '17 at 16:23
  • Neat use of seq. So obvious when you see it - but it never occurred to me. Thnx! – Claus Andersen Aug 16 '17 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.