ipfw divert with layer2 (if_bridge) packets

[Andrew Thompson]

On Tue, May 09, 2006 at 05:45:02PM -0300, Carlos E Gaspar wrote:
> Hi.
> 
> I have the following setup:
> 
> FreeBSD abc5.5-PRERELEASE FreeBSD 5.5-PRERELEASE #0: Wed Apr 26 14:58:22 
> BRT 2006     root at abc:/usr/src/sys/alpha/compile/ABC alpha
> 
> bridge0: flags=8043<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
>        ether xx:xx:xx:xx:xx:xx
>        priority 32768 hellotime 2 fwddelay 15 maxage 20
>        member: de1 flags=3<LEARNING,DISCOVER>
>        member: de0 flags=3<LEARNING,DISCOVER>
> 
> de1 is my internal interface (local) and de0 the external (internet). 
> host1 is on de1. Bridge works fine (if_bridge).
> 
> With the following sysctl's:
> 
> net.link.bridge.pfil_onlyip: 0
> net.link.bridge.pfil_member: 1
> net.link.bridge.pfil_bridge: 0
> net.link.bridge.ipfw: 0
                  ^^^^^^^

This should be 1. 

 net.link.bridge.ipfw   Set to 1 to enable layer2 filtering with
                        ipfirewall(4), set to 0 to disable it.  This
                        needs to be enabled for dummynet(4) support.
                        When ipfw is enabled, pfil_bridge and
                        pfil_member will be disabled so that IPFW is
                        not run twice; these can be re-enabled if
                        desired.


Give that a try.

cheers,
Andrew