Forgive me if this has been asked already but I can’t find what I’m looking for. I’m also a network novice. I’ve read the Bridging section of the pfSense docs but I can’t fully comprehend it.
I have an SG-2100 set up as a gateway router for my network. It gets its WAN address from a separate firewall. The WAN uses a private 10.x.x.x IP, as do its LANs. Connected to its four ports are:
LAN 1 - WAN on internal subnet SG-1100
LAN on internal subnet SG-1100 is connected to a UniFi 24-port layer 2/3 switch
The router uses the default VLANs (Not my idea)
LAN 2 - WAN on DMZ SG-1100
LAN 3 - Empty
LAN 4 - Connected to the SPAN port NIC on my Security Onion Sensor
We have multiple VPNs connected to the internal subnet router (not the gateway router). I need to monitor traffic on the internal subnet and all VPNs. I believe I need to create a Bridge on internal subnet to do that. What I’m confused about is which interface to use as the member and which to use as the SPAN. Do I use the WAN as a member and LAN as the SPAN or vice versa? Once I have the bridge set up as an interface, how do I tell it to use LAN port 4?
Thanks in advance for your guidance.