Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to force certain external IPs to go through certain gateways

    Scheduled Pinned Locked Moved
    Routing and Multi WAN
    4
    15
    7.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nikkilocke
      last edited by

      That makes no sense to me at all.
      fixedip is an address out there on the Internet.
      I want all packets FROM my LAN TO fixedip to go via my 1st WAN port
      Why should I put fixedip in as the SOURCE of the packets???

      Just to clarify, the reason for this is that fixedip has its own firewall, which will only accept connections from 1 IP address, the external address of my 1st WAN router.

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        Ah.
        In the previous description it sounded like you're trying to force one of your internal clients to a specific WAN.

        Can you show a screenshot of your rules?

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • N
          nikkilocke
          last edited by

          A screenshot of my rules will tell you no more than the typed in "screenshot" I included in the first message (other than revealing the actual internal IP address of the external ADSL router in question).

          1 Reply Last reply Reply Quote 0
          • GruensFroeschliG
            GruensFroeschli
            last edited by

            You typed what you think you have.
            A screenshot shows what you actually have.
            You wouldn't believe what kind of descriptions we've got here and the screenshot showed that the rules weren't anything like described ;)

            We do what we must, because we can.

            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

            1 Reply Last reply Reply Quote 0
            • N
              nikkilocke
              last edited by

              I promise it's right. I've checked it more than twice.

              1 Reply Last reply Reply Quote 0
              • K
                ktims
                last edited by

                Well, the columns don't match up with what my web interface looks like, and you can't have any in the protocol field with a port specified, so there's a disconnect somewhere…

                Please just take a screenshot, it makes things much more clear.

                1 Reply Last reply Reply Quote 0
                • N
                  nikkilocke
                  last edited by

                  Perhaps you are running a different version of pfSense to me - if you check the attached against my original post, you will see the original post was correct (aside from my changing the names).

                  I have censored the output - I am not happy about revealing more of my firewall setup than absolutely necessary on the public Internet. The IP address shown is the internal IP address of my first ADSL router.

                  firewall.JPG
                  firewall.JPG_thumb

                  1 Reply Last reply Reply Quote 0
                  • GruensFroeschliG
                    GruensFroeschli
                    last edited by

                    So if i read this right:
                    you have an alias SMTP which contains the port 25.
                    And you use this alias in the destination fiel which expects an IP.
                    Try to set this alias in the field destination-port instead of destination.
                    For this you have to set the protocol to Tcp/udp. Otherwise the destination port field is hidden.

                    We do what we must, because we can.

                    Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                    1 Reply Last reply Reply Quote 0
                    • N
                      nikkilocke
                      last edited by

                      Thanks for pointing out the problem with the SMTP rule. It shows the danger of using aliases. I would have expected the UI to tell me if I used a port alias in an IP address field. Are rules not validated at all?

                      However, that's not the rule I am trying to debug.

                      Please concentrate on the rule I am trying to debug, which is the one which should send all data destined for the IP address in the alias "fixedip" out via WAN1.

                      1 Reply Last reply Reply Quote 0
                      • O
                        overand
                        last edited by

                        Can you show us a screenshot of what you get when you mouseover the "fixedip" alias?  Then, if possible, show us a traceroute giving you the unexpected behavior?  (On windows, I'd suggest "tracert -d whatever.you.are.going.to)

                        (Please confirm the pfSense box's IP as well as the IP of the machine you're testing from, for completeness.)

                        1 Reply Last reply Reply Quote 0
                        • N
                          nikkilocke
                          last edited by

                          I withdraw the complaint in shame and bewilderment - I can no longer reproduce the problem!

                          I have just done 6 tracerts to the fixedip address, and they all went through the correct gateway.

                          Thanks very much for helping though (and at least my SMTP rule works properly, now you've kindly debugged it for me)  :D

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post