How can I still use system routing when changing Firewall --> Gateway?
-
I'm running pfSense 25.07.1-RELEASE (amd64) and have my default gateway set to a WireGuard VPN. However, I need certain hosts to use my regular ATT gateway instead.
To achieve this, I created an alias called Non_VPN_Hosts, added those hosts to it, and made a Firewall Pass rule that forces traffic from that alias through the ATT gateway.This part works, but after doing so, those hosts can no longer reach other networks (LAN/VLANs) as they previously could. I suspect this is because specifying a gateway in the firewall rule causes traffic to bypass the system routing table (as noted under Firewall → Rule → Advanced → Gateway)?
Is there a way to route these hosts through the ATT gateway for WAN traffic only, while still allowing them to use the system routing table for local network access without creating a bunch of additional firewall rules?
-
@alteredstate see https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#bypassing-policy-routing
-
@SteveITS Thank you very much, this was the nudge I needed! I have non VPN hosts on various VLAN interfaces so I created this Floating firewall rule with an Invert match to alias: RFC1918 and it appears to have resolved the issue.
Action: Pass
Apply the action immediately on match: Check
Interface: Any
Direction: In
Address Family: IPv4
Protocol: Any
Gateway: ATT
Defaults for the other settingsIs this acceptable or should I have went about this differently?
