Hey Heper,

I did try that first off, however it didn't work.

So I just went with the one host.

But I did learn today I must flush the tables after doing radical changes…

I'll have a stab at it later on when it gets quiet, and flush the tables after..

Many thanks,
marki

Anyway, I got around it by shoving both networks down the same trunk and using the layer 3 capabilities of the switch to route and access list the public network.

the pfSense rate limiting is working well.

mark

As far as i know using alias' is the way to go, like you pointed out yourself …..

For me, its VIP.IP-Alias.  :)

Thanks all for your help!

Weird, I didn't get an email notification about an update to this thread and decided to manually check.  Thanks for the info, will give that a shot soon and report back.

That means that when you use that utility (ping in this case) it will go out your primary WAN, WAN1, no matter what you can not have it go out a secondary WAN (WAN2, WAN3 etc)

Port forward on the LAN interface (or whatever internal interface)

Interface: LAN
Protocol TCP
Source: LAN/internal subnet
Source port: any
Destination: any
Destination port: 80
Redirect Target IP: server ip to redirect toward
Redirect Target Port: whatever port your proxy is running on

That would do it on a normal system, not sure if the bridge might make that fail in some way. Usually you can't reflect back out the same interface it comes in, so your proxy should be on a DMZ or other internal interface. If it's in the same subnet as the bridged interface(s), I don't think it would allow the redirect to work properly.

I don't understand what you mean by VLAN gateway.

If you assign LAN to VLAN10 (NOT bce1), and LAN IP is 10.0.10.1, then you set default gatway 10.0.10.1

I'm not sure where 10.0.10.254 comes from. From your PC what does ping 10.0.10.254 show? ping 10.0.10.1? arp -a?

What's there to explain?

I have something like this. 2 ADSL from the ISP. These ADSL modem are bad, since you do IP passthrough and the address assigned to the WAN is such as

IP: 33.1.2.3
SUBNET: 255.0.0.0
GW 31.1.2.254

No issues, but connect another one and it's the same. Dynamic IP so it changes. Both IP start with same octet at times, e.g. 2nd WAN:

33.99.2.5
SUBNET: 255.0.0.0
GW: 31.99.2.254

See the issue?

So you connect your WAN 1 to a cheap NAT router, set the LAN IP to e.g. 10.10.0.1/24
So you connect your WAN 2 to a cheap NAT router, set the LAN IP to e.g. 10.20.0.1/24

Issue solved! If your not sure what I'm saying read up on CIDR.

@heper:

perhaps the dns servers of your WAN1 ip are set…..

it happens a lot that isp's only allow their customers to use their dns'.

Set dns to 8.8.8.8 (google public dns) and see if that sorts it out

This couldn't be the problem, because he couldn't ping any public IPs.

http://forum.pfsense.org/index.php/topic,33895.0.html

I do have this option because the endpoint is a ZyWALL USG, which has support for dynamic clients. The solution could however be reformulated to having two tunnels with different priorities. In case the tunnel with the higher priority goes down, the one with the lower priority is activated. In my case their endpoints would be the same, but for others this does not have to be so. Subnet overlaps do not matter anymore when the tunnels are never both active at the same time.

I solved this issue by creating firewall rules for the sites.

Best bed would be create a alias with the required ip's of the sites you are visiting that require single ip and add a rule to use a certain gateway, ensure they are at the top of the list. fixed the issue for me.

Thanks-  Seems to work just fine but I had one of those "wait a minute" type moments…