Eugene thanks for the hand! SOLUTION ADOPTED. Just to have documented in case other people also needs this. Since I'm a new to PF (pfsense) I didn't manage to correctly solve this subnet routing problem. So as I'm using Virtual machines for PFsense, I just created a PFSENSE02 machine, and now my current PFSENSE01 has its WAN with a static DMZ ip address. This way I could isolate the subnets avoiding routing problems. I'm far from proud of the solution adopted, but business comes first, so what matters is making the clients happy! INTERNET (cable) –- WAN-PFSENSE02-LAN ---- WAN-PFSENSE01-OPTWAN --- INTERNET (symetric line)                                                                                     |                                                                           LAN / DMZ / OTHER NETs

I#ve made a diagram of our network setup for better understanding. The goal is, that clients within the 10.10.10.x network can access the 10.150.111.x network. They currently can ping the 10.150.111.20 ip (this is the opt1 interface at pfsense) but can't ping the 10.150.111.17 adress (this is the vpn router) [image: iW_-_Setup.png] [image: iW_-_Setup.png_thumb]

can you describe what solved your problem? because i have the same :)

I still think it is all caused by the high latency of the satellites. In the pfsense book, the command that is checking for a failure is: ping -t 5 -oqc 5 -i 0.7 This is what may be causing your problems, due to latency. It only waits 0.7 seconds between each ping and it waits 5 seconds for a response. According to the book these options are user changeable in 2.0 but jimp or cmb know where this setting is held. That would allow you to tweak it in version 1.2.3

Sorry I forgot to mention Http works fine and it fails over fine, but ftp does not even connect with the LoadBalancing & FailOver  Setup Thank You

just a bump. i'd like to see this resolved in the next release, as i think it's a valuable feature. thanks, -matt

http://blog.pfsense.org/?p=509

Can you explain better what you mean with: "but on the 4096/512 lines the upload traffic goes up to 1.5meg per line (the line only support 512k)" This doesn't really make sense. If you want to balance uneven you can add a single line multiple times to the pool, thus weighting a link more.

Are you even using a DMZ? You need to adjust the various rules and so-on that are in the tutorials to match your own addresses if you're not going to use the ones in the example.

That's right dotdash the gatey way is xxx.254. I have reset the pfsense and made the tutorial from GruensFroeschli again and now it functions!!!! Thanks a lot!!!

ok.. some of the logs of my opt1 interface: Apr 7 16:35:44   opt1   192.168.1.102:51072   192.168.1.254:53   UDP Apr 7 16:35:44 opt1 192.168.1.102:58188 192.168.1.253:53 UDP Apr 7 16:35:44 opt1 192.168.1.102:53841 192.168.1.254:53 UDP Apr 7 16:35:44 opt1 192.168.1.102:59647 192.168.1.254:53 UDP Obviously DNS queries. So i can confirm the packets reach OPT1 interface. If I enable vpn, the 192.168.1.0/24 clients actually can connect to my 192.168.5.0/24 clients (thru vpn but slow as hell) Problem is that… well packets are not routed between subnets... Smth is wrong in my pfsense config....

From the 1.x subnet, does a ping to a 3.x system get a response? oooooh bugger :D Thank you! This was exactly the problem. I didn't have a default route back into the .3 subnet - stupid me. The pfsense box was configured ok, but on the .1 client there was a different default gateway which didn't know anything about the .3 subnet. Thanks again! Works now :)

I did a google search on the matter and they all seem to point to a company called peplink.  After looking at there specs, it offered 7 different load balance algorithms in addition to round-robin, I guess: Weighted Enforced Persistence Priority Overflow Least Used Lowest Latency Load Balancing Algorithms Does anyone know if they work or lockup under heavy load?  Their prices are too high, in my opinion…  Sure wish pfsense offers a few more algorithms to utilize my wans more efficiently.  Or perhaps thru addons....???

@handanril: http://www.pfsense.org/mirror.php?section=tutorials/policybased_multiwan/policybased_multiwan.pdf Don't use that, it's outdated and partially wrong. I just overwrote it with a pointer to the current documentation here: http://doc.pfsense.org/index.php/MultiWanVersion1.2 though it'll take a bit for the mirrors to sync. and that's not really thorough, the best source of info is in the book.  http://pfsense.org/book

It works. Thanks a lot!!  ;D

You'd have to put a NAT device on one of them since the gateway IPs are the same.

You can manually configure lagg to accomplish that. Nothing in the GUI til 2.0.

@lordarcane: Any example config on how to implement this? My company are about to implement a backup (copper) line. So, my first thought was two pf sense boxes, one primary, with the wan on the fibre channel, and one secondary, with the wan on the backup line. Then running carp for the external and internal ip failover and pfsync between the boxes. Would this be right? It would not be dual wan, but dual pfsense. =) Sure, you can do that. Detailed examples in the book.  http://pfsense.org/book