Chosen Gateway Ignored

meluvalli

I have two internet providers coming into pfsense.

I have one named WAN and the other named WIN_NW_SHARE.

I have a rule under FIREWALL/RULES/LAN

Simple rule... If you are trying to get to destination 8.8.8.8, use WIN_NW_SHARE! Everything else, use WAN.

   Protocol: IPv4
   Source: *
   Port: *
   Destination: 8.8.8.8
   Port: *
   Gateway: WIN_NW_SHAREGW

Problem:
This works if both connections are up and running. However, if for whatever reason WIN_NW_SHARE goes down, it then routes the traffic into WAN! WHY?????!!!!!! I have a RULE that states to use WIN_NW_SHARE! The traffic should just FAIL. Example: ping 8.8.8.8 should request time out! It doesn't! Instead it decides to use WAN!

I tried creating another rule right under it with a REJECT action... Thinking it's just skipping this rule, but this doesn't fix the problem either.

Why would it just randomly select a different gateway if the chosen gateway fails? I also forgot to mention, I have selected "Disable Gateway Monitoring" and "Disable Gateway Monitoring Action" on the WIN_NW_SHAREGW. Nothing works!

johnpoz

@meluvalli You prob want to setup a kill switch, like users do when their vpn goes down..

What do you have for this setting?

I believe when gateway goes down, it leaves the rule without the gateway set. So it would just use the default gateway in this case. It is in advanced, misc

I have never bothered to look into a kill switch, but I have seen many a post about it.. If you google pfsense kill switch sure you find some info.

I believe one way is to tag the traffic and use an outbound rule that matches on the tag to block it going out normal, I have never given it much thought, since I have zero use for it..

But if your rule that policy routes out traffic out gateway X also tags the traffic, and you have an outbound rule that prevents tagged traffic from going out gateway Y, that should work in theory. Cuz by default, if a gateway is down, the rule is still there just not with a gateway set on it for your policy route.

SteveITS

@meluvalli can you show your two rules?

https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#enforcing-gateway-use

meluvalli

@johnpoz

I think you hit it on the nail! “Skip rules when gateway is down” sounds exactly what I need. If I enable this, then it should go to my next rule which is to block the traffic altogether:)

Thank you @johnpoz