Transparent bridge+gif

A

Alexey.SPB

How do I make a network using bridge(4) + gif(4)? Is it possible?

10.218.131.0/24(Private network)
|
10.218.131.1(FreeBSD 10)
|
Ext_IP1
|
Internet
|
Ext_IP2
|
10.218.131.2(FreeBSD 10)
|
10.218.131.0/24(Private network)
 
We have a brief section in the Handbook (http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-bridging.html) mentioning a Layer 2 VPN.

Two Ethernet networks can be joined across an IP link by bridging the networks to an EtherIP tunnel or a tap(4) based solution such as OpenVPN.
Click to expand...

Using a layer 3 setup is a bit simpler and easier to work with so you'll probably find more information on that. However, if you want to stick with the layer 2 approach you certainly can. Keep in mind that gif(4) won't automatically encrypt anything so using a VPN when you are presenting this as a local network is probably the safest approach. You'll probably find more information about the OpenVPN approach as well. Reading documentation regarding setting up a bridged OpenVPN network would be a good place to start.

https://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html
 
Hi Junovich!

OpenVPN powerful product, but I want configure only tools FreeBSD. My problem is that as soon as gif add to bridge packets are not visible on the other side bridge.
 
My steps on the server 10.218.131.1 (FreeBSD 10, Ext_IP1):
cat /etc/sysctl.conf
Code: 
net.link.bridge.ipfw=0
net.link.bridge.pfil_bridge=0
net.link.bridge.pfil_member=0

ifconfig gif0 create

ifconfig gif0 tunnel xx.xxx.xxx.28 yyy.y.yyy.138 mtu 1500 up

ifconfig gif0
Code: 
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
        tunnel inet xx.xxx.xxx.28 --> yyy.y.yyy.138
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

ifconfig em0
Code: 
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
        ether 70:71:bc:71:d5:95
        inet 10.218.131.1 netmask 0xffffff00 broadcast 10.218.131.255
        inet6 fe80::7271:bcff:fe71:d595%em0 prefixlen 64 scopeid 0x1
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active

ifconfig bridge create
Code: 
bridge0

ifconfig bridge0 addm gif0 addm em0 up

ifconfig bridge0
Code: 
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 02:65:58:8b:68:00
        nd6 options=9<PERFORMNUD,IFDISABLED>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 1 priority 128 path cost 200000
        member: gif0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 7 priority 128 path cost 55

On the server 10.218.131.2 (FreeBSD 10, Ext_IP2) analogically:
cat /etc/sysctl.conf
Code: 
net.link.bridge.ipfw=0
net.link.bridge.pfil_bridge=0
net.link.bridge.pfil_member=0

ifconfig gif0 create

ifconfig gif0 tunnel yyy.y.yyy.138 xx.xxx.xxx.28 mtu 1500

ifconfig gif0
Code: 
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
        tunnel inet yyy.y.yyy.138 -->xx.xxx.xxx.28
        inet6 fe80::ec4:7aff:fe40:63e1%gif0 prefixlen 64 scopeid 0x6
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
ifconfig bridge create
Code: 
bridge0

ifconfig bridge0 addm gif0 addm em0 up

ifconfig bridge0
Code: 
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 02:7f:9b:38:eb:00
        nd6 options=9<PERFORMNUD,IFDISABLED>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: gif0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 6 priority 128 path cost 55
        member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 1 priority 128 path cost 2000000

ifconfig em0
Code: 
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
        ether 0c:c4:7a:40:63:e1
        inet 10.218.131.2 netmask 0xffffff00 broadcast 10.218.131.255
        inet6 fe80::7271:bcff:fe71:d595%em0 prefixlen 64 scopeid 0x1
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
 
Last edited by a moderator:
Awesome stuff! Thanks for adding your steps on how you did this. To clarify, my suggestion toward OpenVPN bridging was directed at finding reference material on how one might do these general steps given the popularity of OpenVPN. Do keep in mind just using a gif(4) device won't add any encryption or integrity checking that using OpenVPN or another VPN solution provides. If all is well please go ahead and edit your original post to mark this solved. Thanks!
 
Using security/openvpn in bridge mode and bridging the tap device onto your real NIC seems like an often recommended solution. There is also net/vtun which is old but still maintained and seems to have this capability.

OTOH I don't see why your example wouldn't work either. It lacks encryption, which I think would be desirable for bridging traffic over the Internet, but logically I think it should work. I found very little mention of this method through Google searches though. There was some mention of the Ethernet driver for the NIC not supporting bridging, but that's just conjecture.
 
You must log in or register to reply here.
Back
Top