@steveits Got it working. Thank you!

@skull07 I am also having this issue with T-Mobile home internet. I get the "duplicate echo reply received" alerts in dpinger but there are no duplicates happening at least not in the packet trace of the WAN interface, I am using an ATT connection as my backup WAN. I seem to get phantom packet loss indications as well randomly where there really are no packets lost. I tried using unique singular public IP's that are not accessed by my systems and the problem still happens. It's something to do with the T-Mobile router and/or CGNAT which does not allow you to use passthrough mode or any options at all for that matter. It also blocks traceroute attempts to get an idea of intermediate gateways. Of course using this router makes for a double and maybe triple NAT scenario but I have no other way to get internet where I live and for most things it works fantastic. Just cant use dpinger anymore to get an idea of the link quality. If anyone does ever figure out what's going on here please post.

I have the same behavior in a similar setup. Did you ever manage to find out what was causing this?

@malicair
9.9.9.9 is not responding to ping requests. So you cannot use this IP for monitoring. Use another one.

For instance 1.1.1.1.
Try to if you get a response on your PC.

If it's okay use it for monitoring in the VPN gateway settings.

Danke für deine Antwort. Ich habe das jetzt anders geregelt. Über Lan und das geht.

@jpvonhemel Yes, some changes will trigger a restart. Some auto-update scripts as well.

@jc2it said in Asymmetric routing with multi WAN and OpenVPN:

Dec 8 14:38:25 php-fpm 50688 /rc.filter_configure_sync: Not installing NAT reflection rules for a port range > 500

@mrsunfire Do you have this message in your "Status/System Logs/System/General"

No.

Its not really that issue I think its actually closer to this https://forum.netgate.com/topic/152745/multi-wan-gateway-option-gets-ignored-in-firewall-rule I may try this later on. It does seem to be skipping the default gateway route in the firewall rule.

Well, YAHOO! I got my system working like I want it to.

I want to express sincere thanks to all who had the patience to point me in the right direction.

johnpoz, Next time you're in my area, get in touch with me. I'll take you out for a nice Buffalo steak!

Bart

@viragomann
OK, seems that I have full connectivity working now. :)

I created rules for both the WAN and LAN interfaces allowing the traffic for the 10.0.0.0/8 network. Initially I had a mistake in only allowing TCP, which showed up in the syslogs so changed that to ANY and now my clients are connecting.

After multiple days of chasing the configuration I'm quite happy that it's now working. THANKS MUCH!!

Now onto my next step of getting the NORDVPN working. (AFTER SAVING MY CONFIG!)

Cheers and have a great day!

@chpalmer thanks, yep. Both are "dumb" modems; the only purpose of the admin interface is for diagnostics. Funny, although the SB8200 is capable of bonding with updated firmware, the ISP refuses to apply it. So, I'm stuck with two separate GigE ports. Not a big deal since that service is only 600/50, but it highlights the asinine nature of DOCSIS.

I do actually have two separate ISPs (WOW and "Comcrap"). I live stream some classes and just wanted to make sure I had redundancy so I don't leave my students high-and-dry. But I've had nothing but trouble ever since adding the Xfinity service. Got the MB8611 for its 2.5GbE port since I had > 1Gbps with Comcast, but c'est la vie.

@scilek said in Load balancing does not utilize one of the gate ways.:

Double NATting? No, I could not do that.

No, triple-NAT. 😊
You have double already at this time. One time NAT happens on pfSense and one time at your ISP.