# FreeBSD 8.1 bridging with ipfw and divert



## dcorsello (Mar 29, 2011)

My goal is to run Snort 2.9.0.4 in IPS mode on a FreeBSD 8.1 bridge.  I've researched this as thoroughly as I know how, and have tried whatever potential solutions I have found in this and other forums and mail list archives. But I still have no success.

I have compiled ipfw, divert and bridge into the kernel. The adapters are in promiscuous mode. Traffic flows across the bridge as long as divert is not in the picture. When I add a divert rule to ipfw, traffic is stopped. However, if I put an IP address on one of the interfaces, and connect directly to that address, traffic is diverted to Snort and then re-injected at the next ipfw rule, as evidenced by the facts that I can connect to the box via SSH, and that the Snort log is populated. (My understanding of how to do more basic testing is limited.)

It seems to me that this boils down to a couple of questions: 

1) Does divert work with bridging in FreeBSD 8.1 or some earlier version?  I find no definitive answer. FreeBSD documentation (which seems outdated) says no, but some forum posts indicate that it is possible, e.g., http://lists.freebsd.org/pipermail/freebsd-net/2008-March/017220.html.  If it is possible, I wonder if someone would be so kind as to share in detail how it can be made to work, and in which version of FreeBSD.

2) Have I missed something in my implementation of Snort 2.9.0.4? This is probably a question for the Snort forums, but any insight shared here would be helpful. The only Snort-related information that's related directly to FreeBSD is that I compiled it from the FreeBSD ports collection with default config options.

The options that I added to my kernel are:

```
device          if_bridge
options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=50
options         IPFIREWALL_DEFAULT_TO_ACCEPT
options         IPDIVERT
```

Although the presence or absence of the following makes no difference that's apparent to me, I added the following to /etc/sysctl.conf:

```
net.link.ether.ipfw=1
net.link.bridge.ipfw=0
net.link.bridge.pfil_bridge=0
net.link.bridge.pfil_member=1
```

My ipfw rules script contains:

```
ipfw -q -f flush
ipfw -q add 00100 allow ip from any to any via lo0
ipfw -q add 00200 deny ip from any to 127.0.0.0/8
ipfw -q add 00300 deny ip from 127.0.0.0/8 to any
ipfw -q add 00400 divert 8000 ip from any to any
ipfw -q add 00500 allow ip from any to any
```

With no traffic flow tags in the divert rule, no traffic makes it across the bridge. When I add "out via bridge0", 1) traffic does make it across the bridge, but no traffic is logged by Snort, and 2) when I stop Snort, traffic continues to flow. To me, this indicates that Snort is somehow being bypassed when "out via" is in place. When I replace "out via bridge0" with "in via em0", which is the WAN-facing interface, no traffic flows across the bridge. When I remove the divert rule, traffic flows across the bridge.

Applicable rc.conf entries are:

```
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em0 addm em1 up"
ifconfig_em0="inet 10.20.70.11 netmask 255.255.255.0 promisc up"
ifconfig_em1="promisc up"
#
firewall_enable="YES"
firewall_quite="YES"
firewall_script="/etc/ipfw.rules"
firewall_logging="YES"
#
snort_enable="YES"
snort_flags="--daq ipfw --daq-mode inline --daq-var port=8000 -D"
```

Any help with this would be most appreciated.


----------



## enhanced (Apr 8, 2011)

I started another thread about this recently: See here: http://forums.freebsd.org/showthread.php?t=22648

I believe this to be a bug with ipfw, if_bridge and divert sockets.  As you can see from the other thread, I have removed snort from the equation and still experience undesirable results.  My next step is to make a pf DAQ module and go that route.  Though I would like to be able to support ipfw also.


----------



## dcorsello (Apr 9, 2011)

I did read your other thread. Had I found it sooner, it would have saved me a lot of frustration. Not sure how I missed it.

I also re-read the Snort manual and the daq0.5 readme, and found it stated repeatedly that ipfw, divert and bridge don't work together. I've known about this problem for a couple of years, but was under the impression, based on the other thread that I cited, that some people have been able to get this to work in newer versions of FreeBSD. I know better now. 

I also want to mention that in re-reading the Snort documentation, my misconception about its being outdated was cleared up. I find the 2.9 manual and readme much more helpful than in previous versions, particularly where inline operation is concerned. It's also encouraging to find Snort represented in this forum. Thanks for your participation here and for replying to my thread.


----------

