I have Soekris single board communication embedded computers which is optimized for low power and network usage. The server has four Ethernet ports. I’ve installed PFSense firewall on it and configure WAN + LAN ports. How do I setup IPv4 software bridge using PFSense so that the rest of ports act as a network switch?

Tutorial details
Difficulty level Intermediate
Root privileges No
Requirements None
Est. reading time 5m
[/donotprint]pfSense is an open source firewall/router computer software distribution based on FreeBSD. FreeBSD supports the bridge device. A bridge interface device can be created using pfSense. A bridge interface creates a logical link between two or more Ethernet interfaces or encapsulation interfaces. This link between the interfaces selectively forwards frames from each interface on the bridge to every other interface on the bridge. A bridge can serve several services, including isolation of traffic between sets of machines so that traffic local to one set of machines is not available on the wire of another set of machines, and it can act as a transparent filter for ip datagrams. This will work at layer 2 broadcast/collision domain.

Our sample setup

The setup is as follows:

           |  NAS       |    (lan)
           |  Server 01 +------>--------+    +----------+
           +------------+               |    |          |                    lan -+          +- wan (rl0)  ISP/Internet 
            +---------+                      |          |   Public IP:        
            | Desktop |                      | PFSense  |   
            +---------+------->----------+   | Host     |                    opt1-+          |
            +------------+                   |          |
            | HP         |                   |          |
            | Printer 01 +------------->opt2-+          |
            +------------+                   +----------+    

        Bridge0 includes following (note only lan interface needs an IP address)
        lan = vr0 = IP:
        opt1 = vr1 = IP: none
        opt2 = vr2 = IP: none

I’m going to assume that you’ve already assigned and configured wan and lan interfaces.

Step #1: Assign opt1 and opt2 interfaces

First, assign and enable all the additional interfaces such as opt1, opt2 and so on by visiting Interfaces > (assign) option:

Fig.01: Assign network ports

Click on each interface name such as opt1, opt2, opt3 and select “Enable Interface“. Make sure IPv4/IPv6 Configuration Type set to “None“. Finally click on the “Save” button:

Fig.02: Setting up opt2 interface

Warning: Only one interface on a bridge should have an IP address. In this example, I’ve assigned IP address to lan interface ( Do not add multiple IP addresses in the same subnet on different bridge member interfaces. Other interfaces on the bridge should remain with an IP type of None.

Step #2: Create a bridge interface

Visit Interfaces > (assign > Bridges option. Click on + symbol to add bridge0 and select member interfaces such as LAN, OPT1, OPT2 and so on. In this example, I’m only selecting LAN and OPT3 as member interfaces for bridge0:

Fig.03: Configure bridging of interfaces (lan and opt3)

My final bridge0 interface will look as follows:

Fig.04: Interfaces: Bridge

Step #3: Adding a firewall rule

You need to add a firewall rule to allow traffic between each interface of the bridge. Click on Firewall > Rules > Select Lan interface. You need to select opt1, opt3 and so on. I suggest that you add a simple rule like “Default allow interface to any rule” i.e. set Protocol: any, Source: any, Destination: any > and click on the “Save” button:

Fig.05: Add a firewall rule

Feel free to adjust firewall rules as per your needs and setup.

Step #4: Test it

Open the Terminal app and try to ping between nas server, printer and desktop using ping command:


🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 14 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf duf ncdu pydf
File Managementcat cp mkdir tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Modern utilitiesbat exa
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg glances gtop jobs killall kill pidof pstree pwdx time vtop
Searchingag grep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
14 comments… add one
  • cvillepete Jan 15, 2015 @ 14:23

    What are you trying to say here: “A bridge interface device cane created using pfSense.” I’m thinking “cane” should be “can be”, so maybe it’s a typo. I haven’t heard of “cane” being a networking/routing/switching term.


    • 🐧 nixCraft Jan 16, 2015 @ 5:26

      It was a typo on my end. Sorry about that :(

    • Franco Apr 20, 2016 @ 7:45

      This person is taking his time to graph an explanation, for people like us. Why waste time to hack him on a spelling mistake?? If you have nothing to compliment on, DO NOT say anything at all…

      • jacko Jan 25, 2017 @ 21:43

        Sometimes English isn’t someone’s first language. Other times English is their primary language but they didn’t pick up grammar growing up. I skipped the grade where we learned some things in grammar and it took a long time and many many corrections of it (had already formed a bad habit), until I’d finally learned.
        Many people in this situation, if the person is being helpful and explaining things like cvillepete did, would rather hear the explanation so they don’t sound like uneducated morons for their entire life.

  • Łukasz Apr 7, 2015 @ 15:20

    Thank you man :)

  • Clyde Trent Jul 14, 2015 @ 12:15

    Good guide. Thanks for the easy to follow instructions. Will test it our now on my own setup.

  • TK WONG Aug 29, 2015 @ 15:13

    Hi, thanks the tutorial, its easy to follow and successfully to assign a 6 ports pfsense firewall/switch.

    TK Wong

  • Jon Strabala Sep 16, 2015 @ 20:15

    Thanks for the guide your tip on setting “IPv4/IPv6 Configuration Type set to “None” on the interfaces OPT1, OPT2, etc – seems to be the missing secret sauce for making a successful bridge.

  • ibrahim Sep 19, 2015 @ 23:41

    Thanks a lot, Very Well Explained,

  • mhunt Mar 20, 2016 @ 2:13

    In the current pfSense, you have to go back to the Interface Assignment and assign the bridge itself, so it will have an OPTX interface.

  • JR Apr 7, 2016 @ 16:35


    I have been fighting to get my new sg-2440 pfsense box to allow my wife’s computer internet access. This solved it. I bridged everything on every tab, except for the WAN.

    Thanks a bunch!

  • alien May 14, 2016 @ 8:53

    i’m a network noob and appreciate this tutorial. i have a slightly different problem if you could please point me to some additional readings where i might find further tutorials to setup my pfsense.
    i used to have a netgear router with an external asus wifi router acting as the access point. the asus was bridged(?) to the netgear from asus-lan-port to netgear-lan-port so that, eg. (netgear) and (asus). when computers connected to the wifi access points, they will get ips assigned higher than and so on.
    i’m trying to replace the netgear with pfsense sg4860 fw, but quite honestly, i might have bitten more than i can chew as a network noob. while the computer that’s connected to the pfsense appliance is quite fast now, i’m unable to replicate the setup where i can connect to the asus ap.
    what i have tried is the following:
    – enabled opt1 and fw rules (following your tutorial here)
    – followed the instructions at https://doc.pfsense.org/index.php/Use_an_existing_wireless_router_with_pfSense

    however, i’m still not getting the proper ip address on my wifi, instead i see a self-assigned ip of which is a typical ip when there’s no dhcp assigned ip.

    what am i missing?

    • alien May 14, 2016 @ 8:53

      ps. thanks much in advance.

  • DragonMan May 25, 2017 @ 11:21


    It is applicable to do the bridging between WAN and LAN interfaces using the same configuration above ?

    also I did disable the Outbound NAT rule generation , but it does not work, am I missing something ?

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum