Static routes ignored in 2.7.0 ?
-
@Derelict Thanks for your answer. So it is a feature, and not a bug? If it is a bug though, any chance to get it corrected in some future pfSense software?
To be honest I would prefer to avoid doing such non-standard things like removing the gateway from WAN interface...
-
@John888 can't you just connect to this other router with some transit network you create?
-
@John888 Not a bug. If you want to route on an interface with multiple routers, turn off route-to (remove the gateway from the interface).
You could also make a separate transit network to that second router on another interface and leave WAN alone.
The "non-standard" element in your configuration is two routers on the WAN interface.
Chattanooga, Tennessee, USA
A comprehensive network diagram is worth 10,000 words and 15 conference calls.
DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM) -
@johnpoz said in Static routes ignored in 2.7.0 ?:
can't you just connect to this other router with some transit network you create?
Seems I will need to think of something, but basically I do not control 192.168.1.1/24 network. It happens I also have no control which gateway is default, nor that I have 172.30/16 network behind another router in the same network. It is just given, real life situation.
-
@Derelict said in Static routes ignored in 2.7.0 ?:
Not a bug. If you want to route on an interface with multiple routers, turn off route-to (remove the gateway from the interface).
You could also make a separate transit network to that second router on another interface and leave WAN alone.
The "non-standard" element in your configuration is two routers on the WAN interface.
It is for sure not common, but I would not call it "non-standard". Just a real life use-case I have to deal with.
Normally, when it comes to routing only, it is perfectly fine to have 0.0.0.0/0 route via one gateway, and use other gateways for accessing specific networks. It is actually very common scenario. Every known to me routing implementation will just use the most narrow choice and send traffic accordingly. In fact this is exactly what FreeBSD is doing in that case, as shown above - route -n show 172.30.222.1 is directing traffic via 192.168.1.200 as expected. Just then - as I understood - some higher pfSense layers kicks-in and override standard routing behaviour. If you do not consider it as a bug - fine - at least I know I need to find some other solution to my problem.
-
@Derelict said in Static routes ignored in 2.7.0 ?:
route-to
Where can read more about this? I can not seem to find any documentation about this.. In routing, the default route would only be used if there is not a more specific route. When you add a route for 172.30/16 that should be more specific than default and you would think that should be used other than the default..
-
@johnpoz https://docs.netgate.com/pfsense/en/latest/interfaces/wanvslan.html#wan-type-interface
The firewall adds route-to to automatic firewall rules for outbound traffic on a WAN type interface which ensures outbound traffic on the interface is sent to the configured gateway.
So effectively this means you can only have one gateway on a wan-type-interface.
-
@Bob-Dig yeah I see the route-to in the rules
pass out route-to ( igb1 209.x.x.x) from 209.x.x.x to !209.x.x.0/20 ridentifier 1000013161 keep state allow-opts label "let out anything from firewall host itself"But why is this set? I would think there should/could be some check box under advanced or something to not set the route-to
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
@johnpoz There can be only one.
Just make it a LAN and do stuff manually I guess.
Probably a good idea anyways if you put gateways on your "LAN".
-
@Bob-Dig well it doesn't effect me in any way shape or form, if I was going to add a 2nd wan, I would bring it in on its own connection, etc..
Just curious more than anything - why add the route-to to the rule?
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.7.2, 24.11 -
@johnpoz said in Static routes ignored in 2.7.0 ?:
I would think there should/could be some check box under advanced or something to not set the route-to
There is. Don't put an upstream gateway on the interface.
-
@Bob-Dig said in Static routes ignored in 2.7.0 ?:
@johnpoz https://docs.netgate.com/pfsense/en/latest/interfaces/wanvslan.html#wan-type-interface
The firewall adds route-to to automatic firewall rules for outbound traffic on a WAN type interface which ensures outbound traffic on the interface is sent to the configured gateway.
So effectively this means you can only have one gateway on a wan-type-interface.
Yes. In the vast, vast majority of cases the WAN is an ISP-type connection. route-to makes things like multi-wan possible without a lot more user wrangling.
If more routers need to be placed on that subnet, remove the upstream gateway from the interface. If you switch to Manual Outbound NAT before you remove the upstream gateway, all of the necessary Outbound NAT rules will be automatically created for you.
The only other thing that changes that I can think of is you could enable a DHCP server out there if you wanted to. And probably RA and DHCP6.
It is a form of policy routing. It overrides the routing table. If you look at policy routing rules, they also have route-to inserted. That's the mechanism in pf that makes it all possible.
-
@johnpoz said in Static routes ignored in 2.7.0 ?:
well it doesn't effect me in any way shape or form, if I was going to add a 2nd wan, I would bring it in on its own connection, etc..
For me it kinda is.
-
S stiff referenced this topic on
