Hi Jason
yeah, i had already figured that same thing out. it was this post that started me in the right direction. Works fine now.

thx for your input though

hi I have the same problem and i think it is messing around some services running on my dmz. I'm having those same errors but in my case i have a pfsense server with 3 interfaces: lan , wan and dmz atached to 3 differents switches. Then i have this other server(a linux box running suse) with only 2 interfaces atached to LAN and DMZ along with the pfsense box. I receive a lot off this messages . The problem is that my pfsense box is the default GW and when client on LAN tryies to comunicate with services running on the linux server but on the "DMZ" side is when i receive those messages. Pfsense knows linux server IS on DMZ (by destination's ip) but receives replies on LAN side. How can i solve this?. I'm thinking this should not be a pfsense issue, but before i put the pfsense I had a linux box running as a gateway , router and proxy, and didn't have this problems, since I installed pfsense I'm having users reporting problems when trying to communicate with services on the DMZ side of my linux box, they can connect but connection is lost after a while. Then they reconnect fine but the connections drop again.

Tks for your help and sorry for the long post.

Running Pfsense 1.2.2
Fito
Asuncion-Paraguay

@frenchsquared:

any idea where that tutorial might be?

Come on, it's not that hard to find. Start here:
http://www.digitalphotomac.com/PFsense

Yes, I mean reset the state table.
Yes, the rule was on top.

BR.

sorry my poor english

If both WANs are using the same gateway IP, you need an intermediate NAT device. The balancing or policy routing is done by gateway IP.

This is correct.

uhm..i think i'm wrong. i applied all rules on all internal interfaces, not on the wan one.
effectly there 's no sense in what i did.

Its a sticky under the hardware section !!!

http://forum.pfsense.org/index.php/topic,1712.0.html

WARNING: DON'T USE PFSENSE WITH SYSTEMS WITH LESS THAN 128 MB RAM!

Various problems can occur on systems with less than 128 MB RAM. It works fine under some limited circumstances, but is NOT supported.

@ktims:

Set the 'primary' IP (I assume these are not part of the /29, and this needs to be the address the upstream router is 'next hopping' for your /29) as your WAN interface address. Set the /29 up as your LAN side, and assign addresses to your VMs as required (use /29 or 255.255.255.248). Shouldn't need to do much else.

Keep in mind though that a /29 is only 6 usable addresses, and you probably want the firewall to have one of those.

Sorry its actually a /28 I typod it  :-[

I must excuse, after having another long time in searching and reading I found the answer for it in the wiki (http://doc.pfsense.org/index.php/What_are_the_limitations_of_PPTP_in_pfSense%3F).

As well I found some other threads that handle this theme, but they were closed or to old to grab them out, so is there a actual state?
I soon will have a try for the beta, is there perhaps somebody who already has some experience with this in the snapshot?

Malte :)

As i said: install pfSense and start playing.
You'd know what a VIP is if you'd look at the GUI.

It stands for Virtual IP.
Since you want to have multiple IP's on the WAN you need to add the additional IPs as VIP.

Try setting your NAT rules to (ext:any)

Also your bittorrent machine will need full access to the internet as you won't know which port the other people are using. people will connect to you on 7500 but you will connect to them on something else, which of your rules is this?

Untitled.png
Untitled.png_thumb

@http://en.wikipedia.org/wiki/Common_Address_Redundancy_Protocol:

A group of hosts using CARP is called a "group of redundancy". The group of redundancy allocates itself an IP address which is shared or divided among the members of the group. Within this group, a host is designated as "Master". The other members are called "slaves". The main host is that which "takes" the IP address. It answers any traffic or ARP request brought to the attention of this address. Each host can belong to several groups of redundancy. It should be noted that each host must have a second unique IP address.

A common use of CARP is the creation of a group of redundant firewalls. The virtual IP address allotted to the group of redundancy is indicated as the address of the default router on the computers behind this group of firewalls. If the main firewall breaks down or is disconnected from the network, the virtual IP address will be taken by one of the firewall slaves and the service availability will not be interrupted.

group = cluster
member of group = node

You "could" solve that without VLANs. (If you have 2 physical interfaces for WAN(s) and the LAN you're serving)
This thread might interrest you: http://forum.pfsense.org/index.php/topic,14005.msg74791.html#msg74791

Thank you,
been having a hard time setting up
this multi wan on 1.2.2.
I,m having exactly the same prob with localhost
and the multiwan howto didn't work for me either.

Will try this one(http://pfsense.site88.net/multiwan.html) .
Thanks again Masters!  ;)