here is a picture of what I'm trying to do:

http://www.tripathy.org/mlppp.jpg

@cmb:

1:1 NAT is specific to one WAN. it'll use that 1:1 NAT when using that particular WAN. you can configure one on each, or one on one of them.

Oh that's just Cool  8)

I've actually just setup two A entries on one of my subdomains so I do a form of primitive incoming load balancing if i needed to

yes I'm using D-link DGE530T and I have changed it with another one … If the interface is really down why in interfaces menu it says all interfaces are up and also I can ping hosts in those vlans through that NIC in pfsense ?

Thanks so much guys! I've gotten the setup up and running. I've managed to turn off one WAN and internet still works! Once again thank you.

thank u very much for ur support i finally solved the prob

wht i did reinstalled pfsense and now i m monitoring next hop isp gateway as u said and added a static route
for dns server on opt interface load balancing is working fine thank u once again

@GruensFroeschli:

Does your gateway allow to be pinged?
I would not use the gateway itself as monitoring IP, but the next hop behind the gateway.

yes and comes back fine with no loss. Did not try the next hop yet.

@Perry:

What happens if you don't have any balancing pools?
Is you wan also DHCP?
From same provider?
basically more information on your wan's

two different providers. both dhcp.
I have also reconfigured OPT1 to be WAN just to test it. works fine.  I am on my way to school I will later post screenshots of my loadbalance rules, firewall rules and interfaces/OPT1 and status/interfaces.

This is by far the most helpful forum i have come across. Thanks guys

your can search for " failed: host is not on local network " on this forum or on google for information on why it happens.

@newfirewallman:

till then go lay infront of a bus.

Wow, classiest post of the week.  Watch out for your karma.

..actually I think I figured out what the issue was after some addition searching.. looks like it was SquidProxy!.. I started to remove packages one by one, and then everything started to utilize both of my connections!  :D

@sam_son:

Hi there Nick I have done the following,

I could not set up carp as it asked for a password to be set and I didn't understand why. Or is this the password of the HGV?

I'm pretty much a Pfsense newbie myself however i believe the password is required becuase carp is used to sync settings between multiple PFsense firewalls.
If your setting up the VID group for the first time it can be anything  ;)
and if your adding each virtual ip to it's own VID group then just put something random in each time  :P

I think i was feeling lazy when I did mine and just mashed a load of keys on the keyboard, not a very scientific way of picking a password  :-[

do u need ips from the same class on both lans?

Thanks and apologies for the lack of info/clarity.

There is only one ISA firewall and this is what I want:

LAN –> ISA --> pfSense (3 WAN) --> internet

I basically would like the ISA firewall to handle firewall/filtering, and the pfsense to act as an open router to the firewall. So if I decided to connect a client directly to pfsense such as:

client --> pfsense; I would expect unfiltered access to the net without any protection but still have loadbalancing. Is this any clearer?

The WANs are terminated as IPs from adsl modem/routers.

Thanks again.

I might be pointing you in the wrong direction, but try turning off sticky connections and/or setting Firewall Optimization Options to aggressive.

Or you could let your modems run in NAT mode, and 1:1 NAT on both to the pfSense.
For outbound you could use the loadbalancer to the modems directly.

But this is a dirty hack.
cmbs solution is better.

You can use pfSense strictly as a router, with IPsec or anything else. You have to make sure all your subnets are specified in your IPsec configuration, you can't use routes to pass traffic over VPN, the SPD of your IPsec controls routing.

Either with external monitoring application / platform / script on a separate machine, or a script / tool installed through shell.

There is no way to configure this through the GUI as of now, and I am not aware there are any packages with requested functionality.

There is a bounty for a similar functionality http://forum.pfsense.org/index.php/topic,13679.0.html

@knjers:

Your broadcast and subnet addressing do not match. One of those is wrong.

That is my fault, I should have posted this in the Virtualization Section.

GruensFroeschli:
Thanks for the advice, I dont think I did this time. The first time around it worked fine, than broke it  ;D followed the same walk through, must have missed a step. i'll report back.

When you define the monitor IP for a WAN there is automatically a static route createdfor this IP to the correct gateway.

The best solution would be several cards trunked into the switch with the appropriate number of VLANS configured.

Fast, flexible and convenient.

But, it seems that this is impossible on pfSense as of yet. A hack is to bridge individual VLANs on each interface, but I continually run into problems trying to implement that. When you add two pfSense machines and CARP, that brick wall suddenly appears just in front of you.

A single card with multiple VLANs works perfectly.