Problems with bridging

puertorico

Renowned Member
Mar 30, 2014
40
9
73
I am having trouble with a virtual firewall setup after getting a new Internet provider.
this is not a production setup.


i have been running different firewall product like pfsense/ipfire as virtual firewalls on proxmox with really good performance without any issues for a long time. i have a HP server with proxmox 3.4 installed
there is 6 nics installed in this server. 2 onboard + a quad nicadapter from hp.


it is configured like this: there is 2 bridges vmbr1 and vmbr0

vmbr0 is connected to:
eth1 eth2 eth3 eth4 eth5 these interfaces act like a switch

vmbr1 is connected to:
eth0 is connected to a vdsl+ modem

The virtual firewall has two nics one connected to vmbr0 and one connected to vmbr0
with this setup i get an ip from the modem via vmbr1 and there is created a local network on vmbr0 with dhcp dns etc.

the problem started when i got a new Internetprovider and instead of a modem i got a mediaconverter.(fibre to rj45) if i connect the rj45 cable to a pc/server without the bridge in the middle i works flawlessly and i get an ip/dns etc.

but when i connect it to proxmox on eth0 through vmbr1 something happens and the link automatically shuts down.after 5 min it will come online again for 2 seconds. And then shutdown again.

iam sure its some kind of link detection that shuts it down because it can't communicate over the vmbr interface. I have investigated in some setting with multi-cast and stp on the bridge but i can't figure it out. i have linked to a dump from wireshark on googledrive
https://drive.google.com/open?id=0B9TV7Mcg4ak9Q2h5aFJ2ak82UHM

maybe someone here got an idea. Help would be greatly appreciated :)
 
Last edited:
the problem started when i got a new Internetprovider and instead of a modem i got a mediaconverter.(fibre to rj45) if i connect the rj45 cable to a pc/server without the bridge in the middle i works flawlessly and i get an ip/dns etc.

but when i connect it to proxmox on eth0 through vmbr1 something happens and the link automatically shuts down.after 5 min it will come online again for 2 seconds. And then shutdown again.

iam sure its some kind of link detection that shuts it down because it can't communicate over the vmbr interface.

Most probable: the mediaconverter does not accept more than one MAC connected to one port; that means connection which switches - regardless physical ones or logical ones, i.e. bridges - not possible.
 
Most probable: the mediaconverter does not accept more than one MAC connected to one port; that means connection which switches - regardless physical ones or logical ones, i.e. bridges - not possible.

Something like this. Its likely your new ISP uses a MAC ACL and some sort of RADIUS auth that only allows a certain mac to be presented on the WAN side.
 
Most probable: the mediaconverter does not accept more than one MAC connected to one port; that means connection which switches - regardless physical ones or logical ones, i.e. bridges - not possible.

You could be right about the maximum numbers of mac's since its only when i Connect it to a bridge. even on a laptop it work directly attached to the wan. if i setup a regular linux bridge on my laptop in between the connection is also dropped.
i am sure it's not the address because i have a another mediaconverter that works, i have tried 2 other routers, a Cisco and one from Ubiquity with no problems. the firewall is running now on dedicated hardware just without the bridge, connected directly to eth0