The easiest way is on the client to add "redirect-gateway def1;" into the custom options, which will redirect the default gateway over the VPN. Alternately, if you are on a recent 2.0 snapshot you should also get a dynamic gateway entry under System > Routing for the VPN connection and then you can use policy routing to selectively route traffic from the LAN side over the VPN.

That has been fixed in recent snapshots.

Turns out this other configuration I tried was causing a problem with some HTTPS sites due to the transparent proxy.  I finally found the best solution in the "Bypass proxy for these source IPs" under the General tab section for proxy server and went back to bridge mode like the setup in my first post.  The "Unrestricted IPs" section under the "Access Control" tab wasn't doing exactly what I thought it was…

Hey Heper, I did try that first off, however it didn't work. So I just went with the one host. But I did learn today I must flush the tables after doing radical changes… I'll have a stab at it later on when it gets quiet, and flush the tables after.. Many thanks, marki

Anyway, I got around it by shoving both networks down the same trunk and using the layer 3 capabilities of the switch to route and access list the public network. the pfSense rate limiting is working well. mark

As far as i know using alias' is the way to go, like you pointed out yourself …..

For me, its VIP.IP-Alias.  :) Thanks all for your help!

Weird, I didn't get an email notification about an update to this thread and decided to manually check.  Thanks for the info, will give that a shot soon and report back.

That means that when you use that utility (ping in this case) it will go out your primary WAN, WAN1, no matter what you can not have it go out a secondary WAN (WAN2, WAN3 etc)

Port forward on the LAN interface (or whatever internal interface) Interface: LAN Protocol TCP Source: LAN/internal subnet Source port: any Destination: any Destination port: 80 Redirect Target IP: server ip to redirect toward Redirect Target Port: whatever port your proxy is running on That would do it on a normal system, not sure if the bridge might make that fail in some way. Usually you can't reflect back out the same interface it comes in, so your proxy should be on a DMZ or other internal interface. If it's in the same subnet as the bridged interface(s), I don't think it would allow the redirect to work properly.

I don't understand what you mean by VLAN gateway. If you assign LAN to VLAN10 (NOT bce1), and LAN IP is 10.0.10.1, then you set default gatway 10.0.10.1 I'm not sure where 10.0.10.254 comes from. From your PC what does ping 10.0.10.254 show? ping 10.0.10.1? arp -a?

What's there to explain? I have something like this. 2 ADSL from the ISP. These ADSL modem are bad, since you do IP passthrough and the address assigned to the WAN is such as IP: 33.1.2.3 SUBNET: 255.0.0.0 GW 31.1.2.254 No issues, but connect another one and it's the same. Dynamic IP so it changes. Both IP start with same octet at times, e.g. 2nd WAN: 33.99.2.5 SUBNET: 255.0.0.0 GW: 31.99.2.254 See the issue? So you connect your WAN 1 to a cheap NAT router, set the LAN IP to e.g. 10.10.0.1/24 So you connect your WAN 2 to a cheap NAT router, set the LAN IP to e.g. 10.20.0.1/24 Issue solved! If your not sure what I'm saying read up on CIDR.