Dual WAN + LoadBalancing + Fail over + Multiply Public IPs
-
Transparent proxy won't work currently with loadbalancing, at least when using the squid package on pfSense itself. Only connections through the pfSense can be balanced. We are working on making the DNS setup easier currently but for the meanwhile you need the procedure with static routes that can be found numerous times here in the forum.
-
What if I am not using pfSense Squid pack? I have a Squid and Privoxy proxy server that is independent, but I would like to make it so they can't get around it. If they can bypass our proxy, they will do it and it means big trouble for us.
-
You can transparently redirect traffic back to your proxy and only allow the proxy to leave to the internet on port 80. These connections then can of course be balnced. This limitation only affects services that are run directly at the pfsense itself.
-
I am having trouble getting everything working now. My fiber line just got down so I am doing some testing. One NIC is plugged int the fiber gateway and the other is in my router for the other line (can't take the internet down). So I followed the load balancing in the documents but it doesn't seem to work right. it says both are down. The only changes are some of the names that were used. I can't figure out why it isn't working like it should.
I have cable with DHCP and a fiber line with Static. Both with different DNS servers. I will try and get some screen shots posted, but the screen shots in that document are almost the same as mine.
-
Make sure you do not use the same monitoring IP at both interfaces. monitoring IPs have to be unique.
-
They are different. One is looking at a router at 10.10.10.1 and the other is looking at the gateway at 64.20.192.185. So they are different. Also found out that my new line has some problems so it is down right now. Will adding DNS servers to the XML config and then uploading really work? And here is a screen shot of my static routes for the DNS, was wondering if I did it right as well as my rules. Getting alerts that something is wrong with one of them, the one that says LAN > WAN + WAN2. It is set up like the help doc for load balancing with fail over.
http://doc.pfsense.org/index.php/Multi-Wan/Load-Balancing
-
The screenshots look valid to me. Make sure your monitor IPs are pingable and mapped to the correct interface. What exactly is the error message that you get? You can copy paste it from status>systemlogs.
-
It is a filter load rule error. I didn't see it in the log. It comes up in the alert window and it says the rule with description "LAN > WAN + WAN2" can't load. This rule is the second one in the list (the one with the bad circle around it). I also have one of my internet's hooked up to the system to get it going but the load balancer shows it off line and I am not sure why. I know the monitor IP is pingable and they are mapped right. My other concern is the DNS, did I set it up right? I also have one DNS from the 2 in the General Settings and the others are in th Static Routes.
-
Here is the error I get:
Acknowledge All .:. 03-01-07 09:32:43 - [filter_load]There were error(s) loading the rules: /tmp/rules.debug:138: syntax errorpfctl: Syntax error in config file: pf rules not loaded The line in question reads [138]: pass in quick on $lan route-to { ( fxp0 ) , ( fxp1 64.20.192.185 ) } round-robin from 192.168.1.0/24 to keep state label USER_RULE: LAN > WAN + WAN 2 .:.
-
Try to convert this rule to 2 rules. 1 that blocks access to the alias through default gateway and another one that passes traffic to any through the pool. That's the same like the one rule with the NOT option.
Does that solve the problem? Looks like there is something wrong with the NOT option to me.
-
What about the DNS? I just want to know if that is OK. Right now both lines are shown as down and one of them is plugged in and running.
Nope, still getting the error message, but it is narrowed down.
Acknowledge All .:. 03-01-07 12:15:32 - [filter_load]There were error(s) loading the rules: /tmp/rules.debug:141: syntax errorpfctl: Syntax error in config file: pf rules not loaded The line in question reads [141]: pass in quick on $lan route-to { ( fxp0 ) , ( fxp1 64.20.192.185 ) } round-robin from 192.168.1.0/24 to any keep state label USER_RULE: LAN > WAN + WAN 2 .:.
Status Proto Source Port Destination Port Gateway Description
pass TCP LAN net * * HTTPsall Wan2FailoverWan1 LAN > WAN2|WAN1 HTTPS
block * LAN net * Internal * * LAN > Default (block)
pass * LAN net * * * LoadBalancer LAN > WAN + WAN 2 -
What version are you running? If this is not the latest snapshot please upgrade. Something is pretty strange with your setup.
-
Updated it this morning before a posted. it is like 2-27-07.
-
Then I'm at a loss. I recommend starting over. There must be something somewhere wrong that we don't find this way. I recommend setting up and testing step by step to see where things break.
-
This was a start over. Followed everything in that wiki for the load balancing. Bet if I followed it again, I will still get the same error and I am nit sure why I am getting the error. Everything looks good.
-
Everything is working now. It might have been hitting the error because the internet wasn't working right. I had a subnet problem in WAN and WAN2 finally got up yesterday. Plugged it all in and load balancing shows both running and did a restart and no rule errors came up. Everything seems to be OK. Do you know if I can block the DHCP range from the internet? This is for a school and the students will bypass the proxy if there is a way to, so we block the DHCP range and put a proxy into there computers so it gos to the proxy then out.
-
I was also wondering about the multiply Public IPs and how I set them up. I made virtual IPs for it and set up NAT Routing with it. I noticed the NAT 1:1 and looked it up. Do I need to put anything in that? I did to see if it would do anything and now I get errors from it.
-
Well I have everything working. Just down to one problem, FTP on the load balance. I put the work around in and it is at the top but it doesn't seem to work. Anyone have any ideas why or what I need to do to get FTP to work on our load balance?
The work around was:
Proto Source Port Destination Port Gateway
TCP LAN net * 127.0.0.1 1-65535 * -
Change the rule to include ports 8000-8020 instead of 65535
-
You only have set 65535 and not the whole range 1-65535. There is an even easier rule to accomplish this:
pass, protocol any, source any, destination 127.0.0.1, gateway default.That should do the trick when it is at the top of your rules at LAN.