by changing either the gateway or the subnet to something that matches each other? http://www.techrepublic.com/blog/data-center/ip-subnetting-made-easy-125343/

There is no way to distinguish a "download" from an "upload" at the firewall level in such general terms. If you can match a connection with a firewall rule, you can direct it out of whichever WAN you like. So you can route specific sources, destinations, ports, etc over different WANs if you want but you can't necessarily identify "download" and "upload" in that way.

https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

Thanks, chpalmer, great document to read and keep as reference. I am born, raised and based in Germany so not everything applies here. But the basics are always right.

Hi

firewall rules perhaps? do you allow from the .90.x ==> 3.x ?

thank you very much for your swift answer! byr

Yes.  You have to pass traffic into pfSense on your transit network from all the subnets that will be source addresses into LAN.

One and the same I think.  On my node when I create the WAN interface it asks for an Upstream gateway or I can create one.  After everything is all set, the edit interface page does not ask for an upstream gateway any more. I think that field is just a convenience to create the gateway entry when you create the interface.

hmmm, well that work. Little easier than I expect :-) Thanks for your help

What load balancing method you are using? service based routing session based routing policy based routing

THANKS  FOR YOUR SUPPORT NOW I CAN ACCESS ALL THE NETWORK

Hi heper. Here's the full timeline: 1. about 2 weeks ago I downloaded the CD .iso and tried to install it on my old mini-ITX system. This was a Via EPIA 800 with 512MB RAM and a 2GB CF card, that has been sat unused in my garage for the past 4 years. 2. I was able to install it on the CF card but I had to disable DMA on all IDE ports. I also found that I had to manually create the default route after every reboot. I was suspicious that it was because my system was so ancient (I bought it in ~2002) so I decided to upgrade it. 3. I ordered some replacement hardware for my mini-ITX case: an Intel Atom board with dual gigabit Ethernet (D2500CC), 4GB RAM, and a new USB flash stick to boot it off 4. I got all of that set up today and again found that the default route wasn't added. That's when I posted my original message - I assumed it was the same as when I ran with the original board, i.e. it would lose the gateway on every boot 5. After posting the message, I configured /tmp and /var to be on ramdisks using the UI, and rebooted. I expected to have to log in again and create the default route, but in fact it has added it automatically. So this must be either because it needed a reboot after first configuring the PPPoE connection (and I didn't do it), or it saved the default route I manually added and restored it automatically on boot.

@jahonix: They would never be complete or fetch all possible scenarios. The same thing can be said of first aid kits, but it doesnt mean that rhey are a bad idea. @jahonix: Better learn your tools of the trade and configure what you actually need. I've been doing networking and computer security for a couple of decades. I've seen a tremendous number of security flaws that have resulted from basic misconfigurations, misunderstandings, and even typos.  Making cofiguration of routing and security more complex and manual a task than it needs to be reduces security. But maybe you can help me out; where can I find a good packet flow diagram for the various routing, NAT, and filtering components that make up pfSense? @jahonix: It's a security product after all. Its also a routing product and that's the functionality I'm talking about.

I have the exact same setup because one of my servers must use one outgoing WAN from a different LAN. See enclosed screen shots, and the server is 10.0.1.240. The gateways only fail in one direction, and I have outbound NAT defined too.      

awesome, Derelict thanks, looks like that's what I am missing. I just tested by creating a IP alias named LocalNetwork with values of 10.0.1.0/24 and 10.2.1.0/24. then add firewall rule of IPv4* LAN1(2) net, * port, LocalNetwork destination, * port, * Gateway to both LAN1 and LAN2 insert that rule before the LB rule. and like magic, it's working correctly now.

Fix is on its way… i have it working here... now i hope it will be approved as a pkg-update ;-)

OK, our ISP added the new net so we can send all traffic to that IP. All is cool.