ovs bridge, propagate link state from physical NIC

[jtl]

Running pfSense as a VM on Proxmox 5.1, a dedicated system just for being a router/firewall.

In the system I'm using the onboard Intel NIC for management of the hypervisor and a have a quad port Intel server NIC for the pfSense VM. Was running PCI passthrough but moved to OVS bridging so I can easily spin up testing VM's and such.

What I'm looking to do is propagate the link state from the physical NIC to the virtual NIC attached to the VM, so if I unplug the ethernet cable from eth5, the vmbr0 NIC for the pfSense VM will be link state down, etc.

Relevant part of /etc/network/interfaces

# WAN
auto vmbr0
allow-ovs vmbr0
iface vmbr0 inet manual
    ovs_type OVSBridge
    ovs_ports eth5

auto eth5
iface eth5 inet manual
    ovs_bridge vmbr0
    ovs_type OVSPort
    ovs_options vlan_mode=native-untagged

# LAN
auto vmbr1
allow-ovs vmbr1
iface vmbr1 inet manual
    ovs_type OVSBridge
    ovs_ports eth4

auto eth4
iface eth4 inet manual
    ovs_bridge vmbr1
    ovs_type OVSPort
    ovs_options vlan_mode=trunk

Thanks

 

[Alwin]

What I'm looking to do is propagate the link state from the physical NIC to the virtual NIC attached to the VM, so if I unplug the ethernet cable from eth5, the vmbr0 NIC for the pfSense VM will be link state down, etc.

In what scenario would that be useful? Besides that, you either try to configure ovs (if such a action is possible) or create a script that runs through cron.

 

[jtl]

In what scenario would that be useful?

This machine is being used as a firewall/router. Having the link state synchronized would avoid issues with functions such as DHCP renewal timing out if the WAN went offline due to an unplugged cable, etc.

Then again I'm sure you could argue that because I'm terminating the WAN handoff on a managed switch, that also obscures the Ethernet link state from the provider to the CPE hand off (fibre)

I made a crude block diagram of my current setup.

       +-----------------+
       |                 |
       |     Internet    |
       |                 |
       |                 |
       +--------+--------+
                |
                |
                |
                |
                |
                |
                |
                |
+---------------+--------------------+
|                                    |
|ONT (optical network terminal, CPE) |
|                                    |
|                                    |
+---------------+--------------------+
                |
                |
                |
                |
                |
                +--------------------+                            +----------------------------------+
                |                    |                            |                                  |
                |Managed switch      +----------------------------+ WAN of pfSense router on Proxmox.|
                |                    |                            |                                  |
                +--------------------+                            +----------------------------------+

 

[Alwin]

I guess, your original approach to passing through the NIC to the pfSense, would be less error prone or configuration intensive. To still have a bridge available for VMs for testing, a DMZ on a second bridge behind the pfSense would be easier to manage and puts the VMs right behind the firewall. And if you don't need the ovs specific bridge, the linux birdge is also vlan aware.