I would use private IP addresses in LAN and let the firewall NAT automatically. then use policy based routing to send traffic to correct ISP. if you have the following rule it it will send all traffic out to WAN2 firewall Rule: Interface LAN:  source IP:  *  Desrt IP: * Dest port: *    gateway: WAN2 so just make some rules above it to send traffic to WAN1 and you are done. if your LAN computers are accessed from outside then you need to setup NAT rules also,

thanks. got it working perfectly.  :)

I appreciate it. Has anyone even seen a commercial product capable of doing this (a single device on each side)?

Well you can do it with nat. I do not recall if you can enter aliases on the nat part but if you can than that's the way to do it. Though failover is not going to work or i do not know if it makes sense here.

One problemi have after setting this up is that the ica session crashes when i try to copy files to a local mapped drive from the citrix session … anyone have any experiences with this?  ??? - anything i need to set up maybe?

Hi Lhrt, Thanks for the note. I did try the Multi-WAN patch which works great for controlling traffic flow of select subnets through specific gateways. Unfortunately, nothing there unfortunately that supports automatic gateway switching if one fails (or load balancing for that matter). Guess I'll need to wait for 1.3. Mantissa

Since I've added this for 3 weeks it's working fine, however OPT1 has failed just a few times during office hours. No complains about loss of internet or failed PAP2T device for now. I will stick with this workaround until better solution comes up. In short: Change /conf/config.xml <system>... .... <afterfilterchangeshellcmd>/usr/local/bin/reset_states.sh</afterfilterchangeshellcmd></system> Create /usr/local/bin/reset_states.sh #!/bin/sh sleep 60 /sbin/pfctl -F state sleep 40 /sbin/pfctl -F state chmod 755 /usr/local/bin/reset_states.sh

THANKS YOU SAVE ME with de 8000-8030 tip.

http://forum.pfsense.org/index.php/topic,7052.msg40058.html#msg40058 you could set the WAN on a unused VLAN.

you use the firewall rules to do routing, it is called policy based routing. each rule has the option for a gateway. if the rule is a pass rule you can specify which gateway the allowed packet should be passed out on. for 192.168.1.102 , have a pass rule with source IP 192.168.1.102  and gateway WAN

Hoba, what about the interface on the static route? is that important? its something that I never understood.

@sai: @Valhalla1: my ip isn't static, its dhcp.. so must I have some kind of NAT'ing router in front of pfsense? the WAN interface can handle DHCP. however the OPT interfaces cannot do this, so you need to have a dsl modem or other router to do the DHCP for you on the other interfaces. great, thanks..  I can remove the cheesy linksys router from the cable/wan side of the equation.  the DSL modem has a nat router function so that should work just fine for the opt interface

Hi I do have a similar problem in my office network. I'm using two WAN connections on is a little poor ADSL(2Mb) & a 256k Leased line to LB. Mine was working very well but recently it started failing for a 10-20 minutes very often. Most of the time both Internet connections goes down but and come up soon(please see traffic graphs attached). The connections are stable and when I checked with ISPs though Traffic graphs shows very less values. Kindly Help me on this! Coz I don't want to loose pfsense, I have spent months on this to tested and implement. Thanks in advanced Manjula [image: Screenshot4.jpg] [image: Screenshot4.jpg_thumb] [image: adsl.jpg] [image: adsl.jpg_thumb] [image: Screenshot3.jpg] [image: Screenshot3.jpg_thumb]

Thank you hoba for the quick answer. Then I put the DSL to the balancing pool.

Good point, I'll have to check tonight at home.  I don't think I have any rules defined so I'll try that out. Appreciate the help, Tony

I don't think that this is possible as an inactive pass rule becomas a block by default. That way it won't hit another rule below in the list with an alternative gateway. This had to be done that way to kill already open states when a pass rule goes inactive. This was part of the specification for this bounty. Click on the schedules hint on the firewallrules tab to read more about that.

You might try pinging with various sized packets to verify your MTU's are sane.