Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multi WAN seems to be poorly implemented

    Scheduled Pinned Locked Moved Routing and Multi WAN
    48 Posts 10 Posters 18.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      Perry
      last edited by

      Did it also happen with sticky connection enable?

      /Perry
      doc.pfsense.org

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        Best to never load balance HTTPS, but sticky connections will work around that most of the time.

        1 Reply Last reply Reply Quote 0
        • F
          frater
          last edited by

          Yes,  sticky connections is/was enabled….

          But, what's that bug that's mentioned in the list?
          I haven't read about it being solved.

          1 Reply Last reply Reply Quote 0
          • C
            cmb
            last edited by

            It's not an issue in 2.0 with multi-WAN.

            1 Reply Last reply Reply Quote 0
            • F
              frater
              last edited by

              Horde gives me the explicit message that I'm coming from another IP all of a sudden….
              What does "sticky" mean?
              I mean... what's the timeframe?

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                Sticky keeps a client_ip+gateway_ip association for as long as a connection state is active. So as long as the browser holds the connection open.

                On 2.1 I have added a box to let the user specify the length of time after the state expires to hold the association, so it can be made longer.

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • S
                  Supermule Banned
                  last edited by

                  When does 2.1 go live??

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by

                    It will probably be sometime after March for that. Still lots of work to go there.

                    2.0.1 will be coming out shortly (maybe today) but it doesn't include that change.

                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    1 Reply Last reply Reply Quote 0
                    • D
                      dhatz
                      last edited by

                      jimp,

                      Is the upcoming change to "sticky" in pfsense v2.1 still using pf's "sticky-address" feature?

                      In the *bsd mailing lists there have been several requests over the years to increase the sticky timeout to e.g. 30min, but no clear solution.

                      1 Reply Last reply Reply Quote 0
                      • jimpJ
                        jimp Rebel Alliance Developer Netgate
                        last edited by

                        Yes, it is done the same way. The timeout for that is controller by pf's src.track timer (see pfctl -st)

                        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                        Need help fast? Netgate Global Support!

                        Do not Chat/PM for help!

                        1 Reply Last reply Reply Quote 0
                        • D
                          dhatz
                          last edited by

                          Thx jimp.

                          What would happen in a load-balancing pfsense setup with two gateways with sticky enabled, if one gateway failed? What would prevent pf from remembering the old (finished) sessions tracks for src.track (e.g. 30 minutes) and keep sending traffic its way?

                          I am having in mind the issue raised in
                          http://lists.freebsd.org/pipermail/freebsd-pf/2006-December/002860.html
                          http://lists.freebsd.org/pipermail/freebsd-pf/2006-December/002861.html

                          In that example they suggest using pfctl -K to remove source tracking entries.

                          1 Reply Last reply Reply Quote 0
                          • jimpJ
                            jimp Rebel Alliance Developer Netgate
                            last edited by

                            I believe the way our multi-wan works none of that info applies, as it does some behind-the-scenes magic when a WAN fails that may be doing the right thing here already. Ermal would have to say for sure though.

                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                            Need help fast? Netgate Global Support!

                            Do not Chat/PM for help!

                            1 Reply Last reply Reply Quote 0
                            • F
                              frater
                              last edited by

                              But what code does that checkbox execute?
                              Can I do something from the console….?

                              1 Reply Last reply Reply Quote 0
                              • D
                                dhatz
                                last edited by

                                To see the code, do a search, e.g.

                                fgrep lb_use_sticky /etc/inc/*

                                Basically it enables the "sticky-address" feature of pf.

                                1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  The code triggered by the checkbox to activate sticky can be found in /etc/inc/interfaces.inc

                                  As for the GUI field to set the timeout manually, here is what does that:
                                  https://github.com/bsdperimeter/pfsense/commit/4573641589d50718b544b778cea864cfd725078a

                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    frater
                                    last edited by

                                    I really ment…
                                    can I write some value to some pseudo-file in /proc or doesn't it work that way?

                                    The checkbox / input field in the php-site does something...
                                    Can you tell us what it does or can this be backported to 2.0

                                    I'm insisting because it's a bit of a show stopper for my implementation....

                                    1 Reply Last reply Reply Quote 0
                                    • jimpJ
                                      jimp Rebel Alliance Developer Netgate
                                      last edited by

                                      Read my last post again, I provided everything you'd need to know to make the change on 2.0.1 by hand.

                                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                      Need help fast? Netgate Global Support!

                                      Do not Chat/PM for help!

                                      1 Reply Last reply Reply Quote 0
                                      • F
                                        frater
                                        last edited by

                                        Did you edit your previous post?….
                                        Anyhow

                                        I applied those 2 patches (I wasn't able to create a patch file from it, but downloaded the 2 raw files with fetch)
                                        I set the timeout to 3600 seconds which should be sufficient.
                                        If this works I will have the best of both worlds (equal spreading of bandwidth and stability)

                                        Tomorrow I will know if it does its job better.

                                        sticky.pfsense.png
                                        sticky.pfsense.png_thumb

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          dhatz
                                          last edited by

                                          @frater:

                                          Tomorrow I will know if it does its job better.

                                          So, what's your impression of the new src.track feature (i.e. sticky with a timeout)?

                                          And have you tested how it handles failure of one of the two gateways? (see my question in the previous page)

                                          TIA.

                                          1 Reply Last reply Reply Quote 0
                                          • F
                                            frater
                                            last edited by

                                            Because there was still one site that gave problems I didn't dare to post immediately.
                                            But I never had any problems accessing the 2 hosting servers of our own.

                                            I think it's working…
                                            I assume it's properly working when your line goes down. The behaviour will depend a lot on what it should do with the current states (flush them or keep them open).

                                            I just updated to 2.01, so I needed to patch it again.
                                            I now did it in a way that is easy to share with the community.
                                            It's a bit less work now....

                                            I do think it should have been backported to 2.01

                                            Cheers and happy new year

                                            
                                            cd /usr/local/www
                                            cp -p system_advanced_misc.php system_advanced_misc.php.2.01
                                            patch system_advanced_misc.php <system_advanced_misc.php.patch<br>cd /etc/inc
                                            cp -p filter.inc filter.inc.201
                                            patch filter.inc <filter.inc.patch< pre="">/etc/inc/filter.inc.patch
                                            

                                            281a282,284

                                            if (isset($config['system']['lb_use_sticky']) && is_numeric($config['system']['srctrack']) && ($config['system']['srctrack'] > 0))
                                                  $rules .= "set timeout src.track {$config['system']['srctrack']}\n";

                                            
                                            /usr/local/www/system_advanced_misc.php.patch
                                            

                                            58a59

                                            $pconfig['srctrack'] = $config['system']['srctrack'];
                                            105c106
                                            <              if($_POST['lb_use_sticky'] == "yes")


                                            if($_POST['lb_use_sticky'] == "yes") {
                                            107c108,109
                                            <              else


                                            $config['system']['srctrack'] = $_POST['srctrack'];
                                                          } else
                                            192a195,200
                                            function sticky_checked(obj) {
                                                  if (obj.checked)
                                                          jQuery('#srctrack').attr('disabled',false);
                                                  else
                                                          jQuery('#srctrack').attr('disabled','true');
                                            }
                                            269c277
                                            <                                                                      />


                                            onClick="sticky_checked(this)" />
                                            278a287,292

                                            " class="formfld unknown" >

                                            >                                                                      "By default this is 0, so source tracking is removed as soon as the state expires. " .
                                                                                                                  "Setting this timeout higher will cause the source/destination relationship to persist for longer periods of time."); ?>
                                            387c401
                                            <                                                                      ---

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.