We’ve a small network with one server, three clients, Internet router (separate), no domain, no DNS. All devices are connected by a bridge on the firewall. As soon as the IP firewall (set use-ip-firewall=yes) for the bridge is enabled, it’s no longer possible to ping the hosts by name. It doesn’t matter which rules on the firewall are set, I’ve tried with allow all, without rules, without drops, the result is still the same, ping by hostname doesn’t work if IP firewall is enabled.
One of the clients responds with IPv6 packets, that works, no matter which rules are enabled, also for IPv6, it works.
I’m trying since many hours, but I can’t find a solution. Actually I use the local hosts file, but it should work without.
Does anybody know how to configure the firewall to allow the Windows short name resolution?
Here’s the configuration of the firewall. It looks like it has something to do with LLMNR packets to the multicast IP 224.0.0.252. The packet sniffer logs the hostname request, but there’s no answer. As soon as I disable IP Firewall for bridge, it works. I don’t understand why it doesn’t work with firewall enabled and “allow anything rules”.
What’s the hardware topology? Your export is of a CCR1009, is it the last hop? No, it is connected to a router you say. So, what is providing DNS for your workstations? Let me see the configuration for whatever is providing DNS too.
We need to know, you need to know, packet flow. When you ping from the command line on a workstation, what is the packet flow from that workstation to the other workstation? That will help.
Is there some reason you want to force bridge traffic to be processed by the firewall rules? Based on your description of the network, I doubt you want to do that.
I expect you probably just want to apply the firewall rules to traffic that will be crossing trust levels, such as private to public interfaces–in other words, routed traffic. If that’s the case, then you should not configure the bridge to use the firewall.
The goal is to allow only traffic to specific destinations on the Internet. I don’t have the possibility to change the architecture or the Internet router. So I thought I could use the firewall as bridge to control the traffic at this point.
As first, there was another network architecture with two LANs 192.168.111.0/24 and .112.0/24. So I configured the firewall as described by tippenring, with the two LANs and public and private Interfaces. When it was finished, the architecture has changed to only one LAN 192.168.112.0/24. So I’ve changed the configuration but I haven’t yet clean up the config with the two LANs. I thought you never know… As next, I’ll clean up the config to only one LAN.
To control the traffic inside one LAN, is it the right approach to set up one common bridge for all devices and to enable the IP firewall or is there a better way?
The problem with controlling traffic within single subnet is that all traffic has to be forced to pass some filtering device (i.e. router’s bridge where you can apply filtering rules). Which, in principle, goes against the basic idea of a subnet where devices are supposed to connect each other directly. If there is third-party L2 equipment (ethernet switches) in play, then forcing all traffic through central point is next to impossible.
If traffic between certain types of devices has to be controlled, it is common to create subnets (either physically separate networks or, more commonly, VLANs using managed switches), which ensure that traffic between those types of devices passes “control point”.
This single control point can control all kind of passing traffic, and internet (WAN) is just one of possible “subnets”.
Thank you for your quick answers and support, it’s solved. As mentioned, as first we had an environment with two subnets. As the firewall configuration was done, the environment has changed to only one subnet and I had to adapt the config to bridge with enabled firewall. Everything was working except of the windows short name resolution.
Today, I’ve cleaned up the config. As soon as I disabled the IP addresses of the second subnet on ether 7 (the earlier uplink port), the name resolution was working… Also after I’ve re-enabld the IP addresses on ether 7, the windows short name resolution is still working.
It looks as were there an issue on the firewall in my case which could only be solved with disable / enable IP address, this also recalculated the routes.
I notice: Be careful with changes on IP address / routes level, do a proper clean up.