bridge issue

A

aht0

I am trying to work out how to get IPTV work in vanilla FreeBSD machine. Got stuck where bridge should request DHCP lease but fails.

What I am trying to achieve precisely: I'd like to separate VLAN4 from WAN (em0) and bridge resulting em0.4 together with "empty" physical NIC (re0). Connected to re0 is Amino STB.

I've created the vlan device and bridge successfully. For some reason

#dhclient bridge0 is resulting
Code: 
DHCPDISCOVER on bridge0 to 255.255.255.255 port 67 interval 3
DHCPDISCOVER on bridge0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on bridge0 to 255.255.255.255 port 67 interval 15
DHCPDISCOVER on bridge0 to 255.255.255.255 port 67 interval 19
DHCPDISCOVER on bridge0 to 255.255.255.255 port 67 interval 17
No DHCPOFFERS received.
No working leases in persistent database - sleeping.

rc.conf
Code: 
clear_tmp_enable="YES"
syslogd_flags="-ss"
sendmail_enable="NONE"
hostname="A32901"
keymap="ee"

vlans_em0="4" #VLAN4 from WAN

#create bridge and configure
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em0_4 addm re0"
ifconfig_bridge0="ether 00:02:02:20:4E:6D metric 10 up" #MAC of an IPTV STB
ifconfig_em0_4="metric 10 up"
ifconfig_re0="metric 10 up"

ifconfig_em0="DHCP" #WAN DHCP request
ifconfig_bridge0="DHCP" #bridge DHCP request

ifconfig_em1="inet 192.168.1.1 netmask 255.255.255.0" #LAN
defaultrouter="192.168.1.1"

unbound_enable="YES"
unbound_flags="-c /etc/unbound/unbound.conf"
sshd_enable="YES"
ntpd_enable="YES"

#DHCP server serving LAN
dhcpd_enable="YES"
dhcpd_flags="-c /usr/local/etc/dhcpd.conf"

gateway_enable="YES"
pf_enable="YES"
pf_rules="/etc/firewall/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""

dumpdev="NO"

output of ifconfig
Code: 
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 10 mtu 1500
        options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
        ether ac:22:0b:4e:50:c2
        hwaddr ac:22:0b:4e:50:c2
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=4019b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,VLAN_HWTSO>
        ether 00:22:07:01:02:a3
        hwaddr 00:22:07:01:02:a3
        inet 80.235.31.117 netmask 0xfffffe00 broadcast 80.235.31.255
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=4019b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,VLAN_HWTSO>
        ether 00:22:07:01:02:a2
        hwaddr 00:22:07:01:02:a2
        inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
        groups: lo
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 10 mtu 1500
        ether 00:02:02:20:4e:6d
        inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255
        nd6 options=9<PERFORMNUD,IFDISABLED>
        groups: bridge
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
em0.4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 10 mtu 1500
        options=103<RXCSUM,TXCSUM,TSO4>
        ether 00:22:07:01:02:a3
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        vlan: 4 vlanpcp: 0 parent interface: em0
        groups: vlan
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33160
        groups: pflog

just in case,/etc/firewall/pf.conf content
Code: 
ext_if="em0"
int_if="em1"
tvn_if="{ em0.4, re0, bridge0 }"

nonroute= "{ 0.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, 169.254.0.0/16,
        172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, 224.0.0.0/3,
        255.255.255.255 }"

service_dhcp = "{ 67, 68 }"

icmp_types = "{ 0, 3, 4, 8, 11, 12 }"
set loginterface $ext_if
set optimization aggressive
set block-policy return
set skip on lo0

scrub from $int_if to any no-df random-id fragment reassemble
scrub on $ext_if all
scrub on $tvn_if all
scrub on $int_if all

nat on $ext_if from $int_if:network to any -> ($ext_if)

pass in quick on $int_if inet all keep state
pass out quick on $int_if inet all keep state

block drop in quick on $ext_if from $nonroute to any
pass in quick on $ext_if inet proto udp to ($ext_if) port $service_dhcp
pass in quick on $tvn_if inet proto udp to bridge0 port $service_dhcp
pass in quick on $ext_if inet proto icmp all icmp-type $icmp_types
pass in quick on $tvn_if proto tcp all flags S/SA keep state
pass in quick on $tvn_if proto udp all keep state
pass in quick on $tvn_if proto igmp all keep state allow-opts


block in on $ext_if all
block drop out quick on $ext_if from any to $nonroute
pass out on $ext_if all


Any ideas? Or should I go with the net/igmpproxy? Latter looks like needing patching first to be usable though (I did send mail to it's maintainer).
 
In no particular order:

Use tcpdump(1) on the DHCP server to see if it's even seeing the traffic.
Reduce the firewall, temporarily, to pass all traffic.
Remove the bridge and make sure you can DHCP on the correct side of the bridge.
 
You must log in or register to reply here.
Back
Top