1

Linux Mint, using hostapd I have a wifi adapter set up in AP mode. I have bridged a VMware virtual network to this wifi adapter and connected it to a VM running pfsense.

Devices can connect to the AP and receive an IP address from the pfsense VM. Connected devices can ping each other and the pfsense VM all in the same subnet, but no traffic can be routed any further. This is not a pfsense config issue, all interfaces have any-to-any allowed for all protocols for testing.

I believe it could be to do with some kind of MAC NATTING that the VMware virtual bridge uses and the combination of that with the wifi adapter being in AP mode may be causing the originating device MAC to be lost somewhere along the line of transmission.

I understand adding the wifi adapter directly into the VM could get around this, but pfsense does not play too well with wifi and hardware support is very limited. Hostapd is working well for the AP solution so I'd really like to be able to get this bridging method to work if possible.

Improve this question
5
  • It does sound a lot like a pfsense config issue... just not a firewall issue, but there's more to pfsense than just the "allow/deny" rules. Have you tried checking what packets are being sent & received, for example, if you see the same packet both inside and outside, are the MACs indeed somehow different on both sides of the bridge?
    – grawity
    Commented Oct 22, 2021 at 13:05
  • In pfsense logs for the LAN any-to-any rule, any traffic with a LAN subnet IP as destination does show up. But if I try and access anything external, nothing shows up, it just doesn't get to the firewall. If I do a tcpdump on the wifi adapter, I can see the occasional ARP request for the mac address of the router from a client. The mac address that is returned belongs to the physical wifi adapter, rather than the virtual adapter within pfsense. Thinking this might be part of the problem but not sure how to get the correct mac address to be returned by ARP.
    – Turbo_Ap
    Commented Oct 22, 2021 at 15:04
  • Actually, if I run a packet capture within pfsense, I see that ARP requests are being answered with the correct virtual adapter MAC address for pfsense's IP. I guess this the vmware bridge driver NATing the MACs so on the host side it will always return the physical MAC. But it remains the same, any traffic destined for any other network doesn't reach pfsense. I think the host OS is interfering with routing somehow.
    – Turbo_Ap
    Commented Oct 22, 2021 at 15:21
  • Does VMware have something like a "host-only" mode that would create a dedicated virtual interface on the host, and allow you to use native Linux bridging?
    – grawity
    Commented Oct 22, 2021 at 15:34
  • Yes it does, and this has worked!! I've kind of fumbled my way through it and now need to go back and get my head around why it's working. But thank you very much for the suggestion and other input, without that I'd probably taken ages before I thought to approach it in that way. As these are just comments I don't know how to mark you as the person that helped. - Perhaps add your suggestion as an answer?
    – Turbo_Ap
    Commented Oct 22, 2021 at 16:39

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.