# Transparent bridge+gif



## Alexey.SPB (Dec 28, 2014)

How do I make a network using bridge(4) + gif(4)? Is it possible?

10.218.131.0/24(Private network)
           |
10.218.131.1(FreeBSD 10)
           |
     Ext_IP1
           |
     Internet
           |
     Ext_IP2
           |
10.218.131.2(FreeBSD 10)
           |
10.218.131.0/24(Private network)


----------



## junovitch@ (Dec 28, 2014)

We have a brief section in the Handbook (http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-bridging.html) mentioning a Layer 2 VPN.



> Two Ethernet networks can be joined across an IP link by bridging the networks to an EtherIP tunnel or a tap(4) based solution such as OpenVPN.



Using a layer 3 setup is a bit simpler and easier to work with so you'll probably find more information on that.  However, if you want to stick with the layer 2 approach you certainly can.  Keep in mind that gif(4) won't automatically encrypt anything so using a VPN when you are presenting this as a local network is probably the safest approach. You'll probably find more information about the OpenVPN approach as well.  Reading documentation regarding setting up a bridged OpenVPN network would be a good place to start.

https://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html


----------



## Alexey.SPB (Dec 30, 2014)

Hi Junovich!

OpenVPN powerful product, but I want configure only tools FreeBSD. My problem is that as soon as gif add to bridge packets are not visible on the other side bridge.


----------



## Alexey.SPB (Dec 30, 2014)

My steps on the server 10.218.131.1 (FreeBSD 10, Ext_IP1):
`cat /etc/sysctl.conf`

```
net.link.bridge.ipfw=0
net.link.bridge.pfil_bridge=0
net.link.bridge.pfil_member=0
```

`ifconfig gif0 create`

`ifconfig gif0 tunnel xx.xxx.xxx.28 yyy.y.yyy.138 mtu 1500 up`

`ifconfig gif0`

```
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
        tunnel inet xx.xxx.xxx.28 --> yyy.y.yyy.138
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
```

`ifconfig em0`

```
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
        ether 70:71:bc:71:d5:95
        inet 10.218.131.1 netmask 0xffffff00 broadcast 10.218.131.255
        inet6 fe80::7271:bcff:fe71:d595%em0 prefixlen 64 scopeid 0x1
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
```

`ifconfig bridge create`

```
bridge0
```

`ifconfig bridge0 addm gif0 addm em0 up`

`ifconfig bridge0`

```
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 02:65:58:8b:68:00
        nd6 options=9<PERFORMNUD,IFDISABLED>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 1 priority 128 path cost 200000
        member: gif0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 7 priority 128 path cost 55
```

On the server 10.218.131.2 (FreeBSD 10, Ext_IP2) analogically:
`cat /etc/sysctl.conf`

```
net.link.bridge.ipfw=0
net.link.bridge.pfil_bridge=0
net.link.bridge.pfil_member=0
```

`ifconfig gif0 create`

`ifconfig gif0 tunnel yyy.y.yyy.138 xx.xxx.xxx.28 mtu 1500`

`ifconfig gif0`

```
gif0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
        tunnel inet yyy.y.yyy.138 -->xx.xxx.xxx.28
        inet6 fe80::ec4:7aff:fe40:63e1%gif0 prefixlen 64 scopeid 0x6
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
```
`ifconfig bridge create`

```
bridge0
```

`ifconfig bridge0 addm gif0 addm em0 up`

`ifconfig bridge0`

```
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 02:7f:9b:38:eb:00
        nd6 options=9<PERFORMNUD,IFDISABLED>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: gif0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 6 priority 128 path cost 55
        member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 1 priority 128 path cost 2000000
```

`ifconfig em0`

```
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
        ether 0c:c4:7a:40:63:e1
        inet 10.218.131.2 netmask 0xffffff00 broadcast 10.218.131.255
        inet6 fe80::7271:bcff:fe71:d595%em0 prefixlen 64 scopeid 0x1
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
```


----------



## junovitch@ (Dec 31, 2014)

Awesome stuff!  Thanks for adding your steps on how you did this.  To clarify, my suggestion toward OpenVPN bridging was directed at finding reference material on how one might do these general steps given the popularity of OpenVPN.  Do keep in mind just using a gif(4) device won't add any encryption or integrity checking that using OpenVPN or another VPN solution provides.  If all is well please go ahead and edit your original post to mark this solved.  Thanks!


----------



## bra1n (Dec 31, 2014)

Using security/openvpn in bridge mode and bridging the tap device onto your real NIC seems like an often recommended solution.   There is also net/vtun which is old but still maintained and seems to have this capability.

OTOH I don't see why your example wouldn't work either.  It lacks encryption, which I think would be desirable for bridging traffic over the Internet, but logically I think it should work.  I found very little mention of this method through Google searches though.  There was some mention of the Ethernet driver for the NIC not supporting bridging, but that's just conjecture.


----------

