SG-2100 MULTI-WAN CONFIGURATIONS
-
@skbnet said in SG-2100 MULTI-WAN CONFIGURATIONS:
I added a firewall rule (pass, any to any). As I want to use this interface as secondary WAN, I assume I don't need to configure a DHCP server on this interface. Do I?
The firewall rule is to allow from LAN to the Internet. If it's a WAN you normally do NOT want that rule since that would allow inbound traffic (including to the pfSense GUI/SSH). And no a DHCP server would be for an internal interface.
There is a doc category for multi-WAN: https://docs.netgate.com/pfsense/en/latest/multiwan/index.html
Also a forum category, if you're asking how to set up multiple WANs you might ask there: https://forum.netgate.com/category/21/routing-and-multi-wan
-
Ah OK, if you're using it as a WAN then you don't need any firewall rules on it. Unless you need to allow in traffic from the internet. So remove (or disable) that rule.
And, no, you don't need a DHCP server on it.See: https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/opt-wan.html
Steve
-
@stephenw10 Still getting "Offline, Packetloss" on my Gateway status.
-
@skbnet Is the subnet mask correct? (i.e. not /32) If the upstream router doesn't respond to pings you can change the monitoring IP or disable gateway monitoring in System/Routing.
-
How have you configured the new WAN? What is the port connected to?
-
@steveits I configured the new discrete port (LAN4) IPv4 Configuration Type: DHCP. It did not work. I also used StaticIP4 with subnet /24, then also it did not work.
I can ping the upstream router but unable to connect to the internet. The upstream router is perfectly connected to the internet. -
@stephenw10 yes, I configured LAN4 port exactly as mentioned in this doc https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html with same vlan id, same lan port, etc..
-
@skbnet Can you post Status/Interfaces text for that interface?
-
Mmm, the fact you can ping the upstream router with static IPs set but DHCP didn't work seems very odd.
Have you confirmed DHCP is enabled on the router but connecting a client to it directly?
-
@steveits Find below the interface text
OPT1 Other <full-duplex> 192.168.0.25
and I can ping the upstream router in both static as well as DHCP IPv4 Configuration Type -
@stephenw10 pfSense is getting the ip from the upstream router in both static and DHCP settings and I can ping the upstream router from LAN. Yes, DHCP is enabled on the upstream router. I can connect to internet just by plugging the lan cable in one of the LAN port of the upstream router.
-
@skbnet said in SG-2100 MULTI-WAN CONFIGURATIONS:
@steveits Find below the interface text
OPT1 Other <full-duplex> 192.168.0.25
and I can ping the upstream router in both static as well as DHCP IPv4 Configuration TypeNo gateway set?
-
@steveits Yes, gateway set to 192.168.0.1 which is the ip of upstream router.
-
@skbnet said in SG-2100 MULTI-WAN CONFIGURATIONS:
IPv4 Configuration Type: DHCP. It did not work.
What exactly failed there then?
What is failing now?
I would leave it as DHCP if that works equally well (or fails the same!) it's easier to troubleshoot that generally. The upstream router will be passing known good values.
Steve
-
@stephenw10 I discovered something now. Even though the status message for OPT1 (used as secondary WAN) shows "Offline, Packetloss" (when I put Static IP4 config) or "Unknown" (when I put DHCP config), I can connect to the internet via OPT1 in both the cases.
I disabled the primary WAN interface just to make sure. I can connect to the internet via OPT1. Thanks for helping me explore this.
Now, if I can connect to the internet via OPT1, why am I getting "Offline, Packetloss" or "Unknown" on my pfSense Status Dashboard?
-
@skbnet What is set as the gateway monitoring IP for that interface? It’s probably not responding to pings. (Also, make it different than WAN)
-
@steveits When I disable gateway monitoring, I can see gateway status "Online" instead of "Offline, Packetloss". When I add google dns or my ISP gateway IP as a monitoring IP, it again shows "Offline, Packetloss"
I can live without monitoring IP for the secondary WAN but don't you think this will create problem when I configure load balancing/failover?
-
Yes, you need to have reliable gateway monitoring for failover.
If you can connect out to the internet via OPT1 you should be able to set, say, 8.8.8.8 as a monitoring IP there and see replies.
I assume you can ping 8.8.8.8 from a client behind the firewall when the main WAN is disconnected? Assuming you have setup some policy routing or failover system route.Can you ping the OPT1 gateway IP from a client behind the firewall?
Check the firewall states in Diag > States. Do you see the monitoring pings on the OPT1 interface.
We are probably going to need some screenshots to review here.
Steve
-
@stephenw10 I can ping 8.8.8.8 from a client behind the firewall when the main WAN is disconnected.
I can also ping the OPT1 gateway IP from a client behind the firewall. But when I put 8.8.8.8 as monitoring IP, I get the same "Offline, Packetloss" status.
I checked the states in Diag > States nad state for monitoring pings on the OPT1 is 0:0.
Should I hard reset and configure everything again? -
Are you policy routing traffic from the client via the OPT1 gateway when you do that?
Can you ping from the firewall itself either at the command line or from Diag > Ping?
