Invisible gateway - bridge
A bridge in our context is a machine with two or more network interfaces, located in between the Internet and one or more internal networks, and the network interfaces are not assigned IP addresses. If the machine in question runs OpenBSD or a similarly capable operating system, it is still able to filter and redirect traffic. The advantage of such a setup is that attacking the firewall itself is more difficult. The disadvantage is that all admin tasks must be performed at the firewall's console, unless you configure a network interface which is reachable via a secured network of some kind, or even a serial console.
The exact method for configuring bridges differs in some details between the operating systems. Below is a short recipe for use on OpenBSD, which for good measure blocks all non-Internet protocol traffic.
 | Please note that this example is not a complete, working configuration. You will need to study your local requirements and adapt the configuration accordingly. As stated earlier in the Chapter called Before we start, neither this example nor any other part of this document should be pasted into your configuration without modification. Also see the I will not mindlessly paste from HOWTOs blog post on a related incident. |
/etc/hostname.ep0
up
/etc/hostname.ep1
up
/etc/hostname.bridge0 (on pre-OpenBSD 4.7 setups:/etc/bridgename.bridge0)
add ep0 add ep1 blocknonip ep0 blocknonip ep1 up
/etc/pf.conf
ext_if = ep0
int_if = ep1
interesting-traffic = { ... }
block all
pass quick on $ext_if all
pass log on $int_if from $int_if to any port $interesting-traffic \
keep stateSignificantly more complicated setups are possible. Experienced bridgers recommend picking one of the interfaces to perform all filtering and redirection. All packets pass through PF's view twice, making for potentially extremely complicated rules.
In addition, on OpenBSD the ifconfig command offers its own set of filtering options in addition to other configuration options (brconfig's functionality was merged into ifconfig for OpenBSD 4.7). The bridge(4) and ifconfig(8) man pages offer further information. A slightly more thorough treatment is available in The Book of PF, available from No Starch Press.
FreeBSD uses a slightly different set of commands to configure bridges, while the NetBSD PF implementation supports bridging only with a slightly customized kernel[1] .