Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    General Question pfsense MULTI WAN Rules and ERROR in Routes ?!

    Scheduled Pinned Locked Moved Routing and Multi WAN
    23 Posts 4 Posters 8.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      onkeldave83
      last edited by

      a traceroute output from netowrk client, with addiotional cable connection from wan to lan switch

      C:\Documents and Settings\OnkelDave>tracert www.google.de

      Tracing route to www.l.google.com [74.125.43.103]
      over a maximum of 30 hops:

      1    <1 ms    <1 ms    <1 ms  192.168.10.9
       2    <1 ms    <1 ms    <1 ms  192.168.10.4
       3     1 ms     1 ms     1 ms  …
       4     4 ms     3 ms     3 ms  ...
       5    13 ms    12 ms    12 ms  ...
       6    21 ms    20 ms    28 ms  ...
       7    25 ms    25 ms    25 ms  ...
       8    30 ms    29 ms    29 ms  ...
       9    28 ms    28 ms    28 ms  ...
      10    33 ms    35 ms    35 ms  ...
      11    29 ms    29 ms    29 ms  bw-in-f103.1e100.net [74.125.43.103]

      he goes directly from wan to internet!

      i think by correct config he have from…...to
      lan -> wan -> internet gateway

      f.e.
       1    <1 ms    <1 ms    <1 ms  192.168.10.10
       2    <1 ms    <1 ms    <1 ms  192.168.10.9
       3    <1 ms    <1 ms    <1 ms  192.168.10.4
      ....

      1 Reply Last reply Reply Quote 0
      • N
        Nachtfalke
        last edited by

        Ähm,

        pfsense is a routing plattform. A router connects two or more DIFFERENT networks. Your network on WAN and LAN are both the same. They are both 192.168.10.0/24

        On the WAN side you could use 192.168.10.0/24 and on the LAN side use 192.168.20.0/24.
        On the WAN side NAT must be enabled or you have to enter a static route for 192.168.20.0/24 on the router which is DIRECTLY connected to the internet. I mean this router which has the IP 192.168.10.4.

        1 Reply Last reply Reply Quote 0
        • P
          phpzilla
          last edited by

          hi  ;D

          take a look here on my network:

          maybe it helps  ;)

          1 Reply Last reply Reply Quote 0
          • O
            onkeldave83
            last edited by

            yeah thanks!

            1 Reply Last reply Reply Quote 0
            • O
              onkeldave83
              last edited by

              this really good! its godlike ;)
              thanks for this example….
              my mistake was the same subnet for lan and wan....thats stupido

              i want to distance from bridging and ta-ta-ta its perfect -> THANKS phpzilla and THANKS Nachtfalke!!!

              to do list:
              other subnets for lan and wan
              one route: from lan to gateway router on wan
              firewall rules all access
              thats all!

              one question left:

              before i had bridged interfaces (wan / lan)
              and this was like a tranparent firewall i think.....i had to only set rules on lan tab for access or denied things on wan and lan!
              yet? can you explain me how is it managed in routed pfsense modell

              f.e.
              have i to set wan rules only in wan and in lan i need only : source lan subet access to any ?

              thanks for help

              1 Reply Last reply Reply Quote 0
              • O
                onkeldave83
                last edited by

                its seems like that wan rules tab is ignort…..?

                when i set in wan firewall rules block any any any any any
                and i set lan rules pass icmp for all

                i can ping www.google.de

                only when i block it in lan tab, i cant ping google.

                therefore i have to only set the lan rules tab ?

                is it right?

                thanks

                1 Reply Last reply Reply Quote 0
                • N
                  Nachtfalke
                  last edited by

                  You have to set the rule in the right direction:

                  If the direction is from LAN to WAN, for example a Client should not connect to or ping google, then you must enter a LAN rule.

                  If you want, that someone from the internet/WAN should be ablte to connect to your LAN (Webserver, E-Mail-Server) then you must enter a WAN rule.

                  Remember: NO rules means everything is BLOCKED.
                  In general you do not want that someone from the WAN/internet should be able to connect to you LAN, therefor there should be no rules on WAN tab.

                  1 Reply Last reply Reply Quote 0
                  • O
                    onkeldave83
                    last edited by

                    at first thanks nachtfalke

                    hmmm,

                    have one more question.

                    when i added a second gateway…..

                    can i set a second static route with same network but other gateway?
                    this strange....one way, two gateways :??

                    i have only one lan but two isp gateways.....all user should use the first gateway and one user the second gateway.

                    thanks for help

                    1 Reply Last reply Reply Quote 0
                    • N
                      Nachtfalke
                      last edited by

                      Yes, you can. For every rule you could specify a gateway.

                      If you have more than one WAN, you should read more about "Load Balancing", "Multi WAN" and "Failover". I think this could be interesting for you.

                      REMEMBER:
                      The firewall rule take effect from top to down. The first rule which matches will be used.

                      1 Reply Last reply Reply Quote 0
                      • S
                        SeventhSon
                        last edited by

                        @onkeldave83:

                        at first thanks nachtfalke
                        i have only one lan but two isp gateways…..all user should use the first gateway and one user the second gateway.

                        that's policy based routing, you can make a firewall rule for this and select the appropriate gateway to use when a packet comes in from the one user.

                        1 Reply Last reply Reply Quote 0
                        • O
                          onkeldave83
                          last edited by

                          f.e.

                          routing

                          192.168.10.0/24   192.168.20.4    WAN
                          192.168.10.0/24   192.168.30.4    WAN2

                          and then in firewall LAN tab (top entries are dominating) one entry for this one user, how should use gateway two (wan2), with gateway entry to wan2

                          is it right?

                          AND…

                          load balancing...thats intressting yes right!
                          is it for two internetconnections....like trunking?

                          thanks a lot for your professional infos !!!!

                          1 Reply Last reply Reply Quote 0
                          • N
                            Nachtfalke
                            last edited by

                            For example, if you would like, that Host A with 192.168.10.25/24 should be routet over WAN2 it could look like this:

                            pass 192.168.10.25 * * * WAN2        This is for Host A over WAN2
                            pass 192.168.10.0  * * * WAN1        This is for all Hosts from 192.168.10.0/24

                            Load Balancing could be used for 2 or more interfaces. Its not really like trunking, its more like Bonding.
                            Seach the forum for Failover, Load Balancing and Multi-WAN. Check the pfsense docs, too.

                            1 Reply Last reply Reply Quote 0
                            • O
                              onkeldave83
                              last edited by

                              ok thanks nachtfalke!
                              i will try this!

                              i found good tutorials for load balancing and failover….

                              but there is a difference in it!
                              some make it with a bridge between the wan connections and some not.
                              what is the better way ?

                              thanks for help

                              1 Reply Last reply Reply Quote 0
                              • N
                                Nachtfalke
                                last edited by

                                Sorry. DOn't know when to use this in bridge mode.
                                I use it without bridge and I think this is the normal way to use Load Balancing. Perhaps there are special scenarios which need another configuration.

                                1 Reply Last reply Reply Quote 0
                                • O
                                  onkeldave83
                                  last edited by

                                  with bridge interfaces, we are on osi layer 2 or?

                                  1 Reply Last reply Reply Quote 0
                                  • N
                                    Nachtfalke
                                    last edited by

                                    Yes, bridging is Layer 2

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.