Policy routing Will do that. (specifying a gateway on a fwrule)

Sorry for the belated reply.

The answer is not specific and definitive.
It appears that FreeBSD is more stringent on the rules it will accept for routing than is NanoBSD.

Look at the way your routes and gateways function.

Well static lags generally only detect link up/down AFAIK.

Then you have more modern stuff like LACP. its a bit more intelligent:
https://www.thomas-krenn.com/en/wiki/Link_Aggregation_and_LACP_basics

When multiple switches are involved you probably want STP (or brandspecific alternative)
https://en.m.wikipedia.org/wiki/Spanning_Tree_Protocol

pfSense Multi-WAN does not care if they are VLANs or physical interfaces. It works the same way.

:-[ Unfortunately I had another one today, 8 out of the 12 processors where going berserk on the interrupts, while there was only 20Mb/s and between 2000 and 5000 pps.

Hi,

Generally speaking, your pfSense box is placed in between your work (1.x) and other (2.x) networks which appears to be acting as a firewall/router.

If you want to continue with a configuration like this, you'll need to do some NAT/Port forwarding AND firewall rules to allow the 1.x network to be able to talk to the specific 2.x network hosts in terms of what ports (i.e.: 443, 80, 22, etc) and protocols (icmp, tcp, udp, etc).

You'd then access the pfSense box's WAN address on the 1.x network and define which port you want to access, which translates over to the proper host on the 2.x via NAT/port forward with some configuration on the pfSense box.

As a side note, you may be able to disable NAT on the WAN interface (1.x) of the pfSense box and then you'd only need to do firewalling. I have never done this before but seems simple in concept.

A cleaner configuration would be to have the pfsense box with multiple network adapters (minimum of 3 in your configuration) which segregates these networks using pfSense, (but using a single box for LAN1, LAN2, WAN, etc),  LAN1 could be the 1.x and LAN2 could be the 2.x. Then you would only need fire walling rules and not also inbound NAT rules/port forwarding. There's some other settings to be applied with outbound NAT i believe but the auto-generated outbound NAT should suffice out of the box in this scenario.

Hope this helps give you some direction on how you want to approach the problem without writing a book.

@WillieBeamen:

Hi.

I need some help, and I think the answer is simple, but I'm not very experienced with routing and networking, so I need some noob-friendly help, or pointers to some threads that might help.

I use an internet anonymizing service (PIA (Private Internet Access) if that helps).  I have 8 PCs (towers and some laptops) in my home, some for work, some for leisure, some just for Netflix, streaming.  I am trying to set up a system so that 1-3 devices stay fully anon (behind the PIA servers) when surfing the internet, but can still share folders / files between the other PCs in my home network (which are not utilizing any anonymizing services at all).

Following the guides provided by PIA I was able to successfully install pfsense to a single tower PC (1 Realtek NIC (embedded) + 1 4-port HP gigabit NIC (PIC-e slot))  and configure OpvenVP services for PIA access.  Amazingly, I got it up and running, but now I have a problem.

Here's my situation at the moment.

My 'work' PCs are all plugged straight into my home router and are using
192.168.1.xxx
These do not (nor will ever) use or need to access PIA's services.

My pfsense Box (which is configured with PIA/OpenVPN (anonymizing traffic)  is configured to use the 192.168.1.xxx gateway, but the LAN address is 192.168.2.xxx

so here's my problem.

Any PC on 192.168.1.x
can't see / share files with any PC on the 192.168.2.x domain.

Is there a way to get devices on 192.168.1.x  to see the devices on 192.168.2.x ?

Or am I going about this all wrong?

apologies in advance, I'm a noob at this, I'm honestly surprised that I was able to even get my pfsense box setup and working with PIA.

Everything would be great, except I can no longer share files between the two domains.

Any (noob friendly) help would be very greatly appreciated.

edited to add:

on the box running OpenVPN:

pfsense:  running 2.3.4-Release-p1 (amd64)
WAN:  is being assigned a gateway from 192.168.1.xxx
LAN:  192.168.2.xxx

He changed his post from his original question..  Yes what he asked now is easy peasy..

Like the Chinese say: those who say it cannot be done should not interrupt the one already doing it.

Bump, I am having the same problem, one PPPoE via VLAN works, adding two or more using VLAN fails.

Thanks for your reply,

Lan rules image has been attached,

Lan-RULE.jpg_thumb
Lan-RULE.jpg

Same fetch, but our pf ruleset has some tricks with route-to that make it work.

I have the same issue. i think there is a bug in "policy base routing".

when you add a rule to "any" destination to change the gateway, it will not work. if you set a specific destination for that rule, it will works.

you can add your rule with "!1.2.4.5" destination to change your client GW till pfsense team fix it.

Thanks for help, I just wanted extra connection to boost large multi-session downloads, Steam, torrent etc.

I managed to get it all working, for anyone else who is in this position:

Follow the PIA guide on how to setup Pfsense for VPN.

Make a copy of the VPN so you have one for each connection (in my case two), make sure each one is set to face the corresponding WAN.

Assign each VPN to an interface.

Under Firewall NAT Outbound where you created rules from PIA guide, you need to duplicate all of them and set the duplicates to the second WAN (if you have more than two connections you'll need a 3rd set of duplicates etc.)

Under gateways add one for each VPN interface.

Under gateway groups add one with all the VPN gateways you just created with Tiers set to 1 (if you want load balancing like I do).

Under Firewall Rules LAN set the IPv4 LAN any rules gateway (under Display Advanced section) to the gateway group you just created, for privacy VPN's it's recommened to disable IPv6, so I set that one to block instead, however if you need this also it to that gateway.

8 ) Reboot Pfsense and check your IP at whatismyipaddress, refresh a few times to double check.

Changed the switch and the problem is gone.

Uh… reported/suggested moving this to Routing forum, and quickly outta here.

True - other than being latest kool thing to play with..  But don't have any clients anyway :(  Or I would prob get one to play with ;)

This is a simple policy route.
https://doc.pfsense.org/index.php/What_is_policy_routing

Make sure that you do not pull routes from your vpn client you setup on pfsense, or it most likely will set your default route out the vpn.  Then the IP of the devices you want to go out your vpn just create a firewall rule saying these IPs (could use aliases to have them all in 1 rule) use the vpn as its gateway.

if these devices need access to other local segments then you would have to put a rule above this routing rule so that they could get access to those networks.