Ygtjki

Tying to logically force ALL laptop traffic (from local KVMs and host) through a local pfSense KVM before leaving the host (fedora). Still want DHCP from the router. I've made significant progress but the routing is giving me grief. Not worried about persisting reboot, I can figure that out later. Open to other methods, but prefer native/efficient solutions. Here's what I have so far.

Desired logical route:

Host 
 ---> pfSense (KVM) ---> wlp2s0 ---> WAP
KVMs /

Added wifi interface to virtual bridge:

iw dev wlp2s0 set 4addr on
brctl addif vmbr2 wlp2s0

vmbr2

192.168.1.254/24
vnet0 (KVM pfSense WAN interface 192.168.0.254/24)
wlp2s0 (192.168.0.106/24, gateway at 192.168.0.1/24)

vmbr3

192.168.1.254/24
vnet1 (KVM pfSense LAN interface 192.168.1.1/24)

Deleted all ip routes, then added static, source-based routing using commands:

echo 200 pfWANout >>/etc/iproute2/rt_tables
ip rule add from 192.168.0.0/24 lookup pfWANout
ip route add 192.168.0.1 dev wlp2s0 table 200

echo 201 pfLANin >>/etc/iproute2/rt_tables
ip rule add from 192.168.1.0/24 lookup pfLANin
ip route add 192.168.1.1 dev vmbr3 table 201

Throwing in the towel for now. I would really like to connect with anyone who is trying this, feel free to comment on this thread even if it grows old. I have found some pages on the interwebs where neckbeards say they figured this out, but there is little elaboration. Here's my current progress with some resources in case someone else is trying this too.

Standard ip routing seems to be the ticket (instead of source-based routing). Still not sure how to configure so that routes eth/wlan routes are added when connecting to routers with different subnets, but not add any other routes that would bypass pfSense. Could just let them populate and manipulate the pfSense default route metric, but good luck making sense of your routing table when you start standing up more KVMs. There must be a cleaner way.

Getting wlan to connect to virtual bridge is infuriating. 4addr method requires accommodating wap configuration, which essentially defeats the purpose. Didn't try installing wlan_kabel, which may work.
https://askubuntu.com/questions/155041/bridging-loosing-wlan-network-connection-with-4addr-on-option-why/277228
https://github.com/escitalopram/wlan_kabel

This has turned into a never ending project. 1 step forward and 4 steps back. Very difficult to wrap your head around configs host, KVM, routing, networking, switching, and pfSense configuration. I've learned a ton, so that part is a success, but after 50 plus hours I'm calling this one quits... for now. Again, feel free to comment on this thread even if it grows old.

1. ipv4 forwarding needs to be enabled.



2. Don't assign an IP to anything between your physical NIC and the pfSense WAN interface.




3. Let pfSense get its DHCP assignment from the AP.




4. Assign a static IP to pfSense LAN interface and enable DHCP server from pfSense to LAN.




5. Enable DHCP client on vmbr3.




6. Enable DHCP client on all subsequent KVM domains added to vmbr3.