Any thoughts on this?
My regards.

Actually this raises a question. On asymmetric links such as this, do you want to base the ratio calculation on the upstream or the downstream numbers? I could see an argument either way– Either you try to fairly balance outbound traffic requests, or assume that the inbound "reply data" will roughly correlate to the # of requests sent out and thus you should try to balance on the downstream number.  Not sure which way is "right" but I lean towards calculating on the upstream, since that's the only thing you can really control anyway.

So this has been resolved.

!! The rule that you would enter to allow OSPF traffic, HAS to be a floating rule.  !!

Otherwise for some reason everything after the 3rd LSA(hello packet) is blocked. I would consider this a bug

Create a tagged switchport with VLANs 2 and 9
Create VLAN 2 on igb0
Reassign LAN to VLAN 2 on igb0
When you hit Apply you will lose access if working from LAN
Patch pfSense into the tagged port.

You can, of course, just change pfSense then change the existing port to tagged.  Just know that when you change pfSense to tagged and Apply, it will not be able to reach LAN until on a tagged switch port and you could lose access to the webgui.

Or access the web interface via another network to make the changes.

huh???

How does lan pfsense have a public IP on its wan?  Is its wan int he dmz as you show, where dmz you state is a private IP..

Take a crayon and draw this on a napkin and post of picture if you have too..  Or use something like gliffy..  But your "drawing" makes NO sense..

Where is this this 3rd nic in your dmz pfsense shown?  You state "LAN (Private IP on same subnet as the LAN subnet)"  So they share the same layer 2 network?

Bump

Hi Ballantine,

I think this is what you should do :

All wifi WAN on seperate subnet say 192.168.2.0 , 192.168.3.0 , 192.168.4.0.

Connect the wifi WANs to managed switch with vlan tag 200, 300 and 400.

Connect the pfsense box to trunk port of switch.

Create vlan tags 100,200,300 in pfsense box. Create seperate vlan interface for each tag with interface ip as 192.168.2.1, 192.168.3.1 and 192.168.4.1 and upstream gateway as 192.168.2.0, 192.168.3.0 and 192.168.4.0 respectively.

For configuring the switch you should look into product manual. In general, in L2 switch there is one port configured as trunk port where pfsense box is connected. The rest of the ports to WAN with different VLAN tags. When the packet pass through them it attaches a vlan-id tag to it.

good luck and have a nice day
Ashima

OK, I Just whipped it up in my ESXi lab.  Works fine for me.

WAN: 10.10.20.1/16
LAN: 192.168.20.1/24
DMZ: 172.16.20.1/24
VIP: 172.16.30.1/24

Lubutunu box @ 172.16.30.10 can ping other Lubuntu box @ 192.168.20.10.

Maybe something burped and you should delete and recreate that VIP.  Also, you might have a rules issue so perhaps post your LAN rules.

So you are natting from a public IPs on wan of pfsense to rfc1918 address on lan side of pfsense..  So if your natting you have to port forward to get traffic from wan to lan..

Perfect and all solved as i wanted.
Really appreciate your help viragomann.

Once again thanx…..

Yes! that was the problem. I thought I'd tried everything. Thanks Jimp!

You can just do NAT to reach your goal.

Add an alias for just one source IP or group of type URL IPs or networks, if you need.
Use this alias in a NAT port forwarding rule as source for the one webserver and put this rule above that one for the other webserver.
If you rule with the specified source match the client is directed to webserver 1, if it doesn't he is directed to webserver 2.

If you want you may also specify source for the second, but this is not necessary.

https://doc.pfsense.org/index.php/What_about_using_multiple_WAN_connections

https://doc.pfsense.org/index.php/Multi-WAN_and_Compatibility

https://doc.pfsense.org/index.php/Main_Page

https://forum.pfsense.org/index.php?action=search