Bridging.. WAN to LAN? or.. Trying to bridge LAN and OPT as a switch?

I have a backup pfsense box at home with only 2 nics.  WAN1 and WAN2 are on VLAN's off the same nic and connected a VLAN aware switch that is connected to the two modems.  The nics and switch are GB which is more than the combined speed of the two WAN connections so the speeds aren't much different than with my main pfsense box that has 4 nics.  Being a backup unit I don't use it much, but it works fine when I do.

@mrpsycho: Hello, i've created 2 lists: whitedomains whitenets whitedomains consists of single IP addresses per line. and it works fine with "Static Routes" and whitenets looks like that: is it possible to create Static Routes for subnets? Yes, when creating a static route, put the alias name in the Destination Network field.  This works for both host lists and network lists.  Downside is that if the alias name is changed, although pfSense will update other tables with the new name, it will not update the static routes entries, you'll have to update the name change in the static route entry manually.  Also if your host list has domain names that round-robbin, your route table will not be updated each time the DNS record is refreshed.  Best to use only fixed IP's in host list if using for static routes. As an added note, you can include single IP address in a network alias list by using /32 mask. (host list just assumes all entries are /32 mask).  This would allow you to only have to maintain one list and one static route entry associated to that list.

"Apparently like 20+ years ago when the network was made, it was a reserved address space?" Maybe not allocated to someone, but sure not reserved for local use.. What does that have to do with today.. That space is current owned by orange, and clearly not part of rfc1918… The correct thing to do would be to re ip it to more appropriate space.

It's a while since I touched a Nexus switch with VRFs. Shouldn't you have the following under the interfaces :- ip vrf forwarding VRF_NAME Also what's the HSRP and EIGRP commands doing there with a single switch, was there some config on the switch when you got it?

Firewall rules maybe ? Firewall on the local clients ? Do a packet capture the far end Diagnostics -> Packet Capture, is traffic flowing down the tunnel. I don't actually use OpenVPN, just putting some ideas out there.

Thanks for your help Johnpoz, I'll investigate on this way (state table) to see if i can solve the problem …. why are Aliases so unloved by the PfSense guru, where this feature has been touted as one of the strengths of PfSense, and what is the negative impact of their use? Does PfBlocker NG derogate from this malaise with its Aliases hijacked features? Thank you in advance for your answers.

The set-up is possible though, but the routes make zero sense. @DemoNIck: where: for the WAN interface under pfSense: General Settings: IPv4 Configuration Type: Static IPv4 Static IPv4 Configuration: 10.0.0.254/24 IPv4 Upstream gateway: NONE Reserved Networks/Block private networks and loopback addresses: NO Block bogon networks: NO Enter the ISP routers internal IP 10.0.0.1 as upstream gateway here. @DemoNIck: for the routing under pfSense: System/Routing/Gateways/ADD: Interface: WAN Gateway: 10.0.0.1 Default Gateway: YES The gateway is set automatically if you enter the IP in the WAN interface settings, as above. @DemoNIck: System/Routing/Static Routes/ADD Destination Network: 192.168.254.0/24 Gateway: WAN System/Routing/Static Routes/ADD Destination Network: 10.0.0.0/24 Gateway: WAN Why want you add routes for networks which are connected to pfSense directly? That's absurd. @DemoNIck: for the routing under my ISP's MODEM/ROUTER: #route add -net 10.0.0.0/24 192.168.254.1 The same here. On the IPS router forward the whole traffic to the pfSense WAN IP.

other factors are just examples…. thanks! will try to create "load balancing"

is there a good HOWTO for that? I have a freebsd decicated server on the internet… and pfSense...

The more information you share that is relevant..  The less you will have to pay for someone else to do it for you.  ;)

OMG, I am a friggin idiot.  when I copied the rules LAN 1 had, I copied them to the T.  I just needed to change the source from LAN net, to LAN2 net.  im such a moron hah.  Everything is working golden now.

https://doc.pfsense.org/index.php/Connectivity_Troubleshooting [image: crystalball.png] [image: crystalball.png_thumb]

They will configure the sonicwall on there end i just need to make sure that pfsense is routing correctly on my end

I'm not sure I understand your problem. Your switches can ping 8.8.8.8 so indeed they can talk to the outside world. What is what does not work? Regular hosts plugged onto those switches are the ones that can't? Also, why all ports on all switches are set up as trunks? Shouldn't you have at least some access ports where you plug in your hosts?

This is dpinger logging parameters at startup. Nothing to be concerned about.

The Monitor ping seemed to do the trick.  Thank you for all of the help!