NG Firewall in Bridge Mode

Overview

When two interfaces are bridged in NG Firewall this means they are effectively sharing a configuration. Bridging two interfaces puts those interfaces in the same network space.

If NG Firewall is installed behind another router or firewall, it is often best if it is placed into "bridge mode".

Standard Bridge

The most common configuration you will see is where the Internal interface is bridged to the External interface. 

For example, if the upstream firewall is 192.168.1.1, then you can configure the External on the NG Firewall as 192.168.1.2/24 with 192.168.1.1 as the gateway. The internal hosts all have 192.168.1.* addresses and can continue to use 192.168.1.1 as a gateway (192.168.1.2 will also work as a gateway).

NOTE: It is important to remember that even when bridging NG Firewall routes ALL traffic according to its routing table. This means if you have any other subnets besides 192.168.1.* (10.10.10.*,172.16.15.*, etc.) then you will need to add aliases or routes for them otherwise that traffic will go to the default gateway.

DMZ Bridge

Another common scenario to use when bridging is when NG Firewall is installed at the gateway and has a public IP (1.2.3.2 in this example).

In this case, you don't want NG Firewall to be in bridge mode, but you have other public servers with public IPs (1.2.3.*) and you want to keep them configured with public IPs to keep them separate from the internal and avoid any NAT/port forwarding issues.

In this case, you can bridge a "DMZ" interface to your external and it essentially shares the configuration and network space with external. This means you can place servers with public IPs on that segment and they can continue to use 1.2.3.1 as a gateway.