• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Dual WAN with Failover Not Working

Scheduled Pinned Locked Moved Routing and Multi WAN
34 Posts 4 Posters 17.5k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • R
    rober1sf
    last edited by Aug 15, 2013, 1:58 PM

    Anyone??

    I'd like to get the pfSense working… just for proof of concept, I tried the exact same network schema setup with a Cisco RV042 Dual WAN router and it worked beautifully with about 10 min of setup.

    Please help.

    Thanks,

    Steve

    1 Reply Last reply Reply Quote 0
    • S
      srk3461
      last edited by Aug 16, 2013, 6:47 AM

      @rober1sf:

      Here is my General Setup…

      Also, I cannot find the checkbox for gateway switching.

      Hopefully these screenshots help; please let me know if another shot would help.

      THANKS!

      That b'cos you're looking at the wrong menu. It's under System -> Advanced -> Misc " Allow default gateway switching"
      Give this thread a read  http://forum.pfsense.org/index.php/topic,64612.msg350227.html#msg350227
      I've explained fail-over clearly in there. Good Luck!

      1 Reply Last reply Reply Quote 0
      • R
        rober1sf
        last edited by Aug 16, 2013, 10:51 AM

        I found gateway switching but checking that box hasn't made this work either.

        Also, srk3461, I think I've done what your other article says to do… What am I doing wrong? Do I need to have all 3 groups and LAN rules even if I'm NOT load balancing?

        1 Reply Last reply Reply Quote 0
        • K
          kathampy
          last edited by Aug 16, 2013, 10:59 AM

          First make it work with a single pfSense box with two public IP WAN interfaces so you understand exactly how to configure pfSense. Then build your (unnecessarily) complex network around it.

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi
            last edited by Aug 16, 2013, 11:04 AM

            Nothing works better for fail-over than two of the same ISP…

            1 Reply Last reply Reply Quote 0
            • K
              kathampy
              last edited by Aug 16, 2013, 11:05 AM

              @kejianshi:

              Nothing works better for fail-over than two of the same ISP…

              …from the same modem.

              1 Reply Last reply Reply Quote 0
              • R
                rober1sf
                last edited by Aug 16, 2013, 11:32 AM

                :( Ok. I understand that one doesn't want dual WAN from the same ISP/modem in a production environment but I have to TEST this in a lab environment before I can put it in a production setting where it doesn't work! This "unnecessarily complicated" network as you say is essentially the exact same setup as having 2 modems from 2 ISPs.

                Why does the pfSense NOT fail over to WAN2 when the Internet traffic on WAN1 goes out? And for proof of concept, I used a Cisco RV042 in the same "unnecessarily complicated" network and the Cisco worked.

                I think there is a software flaw with pfSense and the dual WAN failover. You guys using it say it works, but are you dropping physical link for it to fail, because that does work. Dropping Internet packets does not work though!!!!!

                I'm begging for help from you guys, so please help if you can; I don't need the sarcasm or rude comments.

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by Aug 16, 2013, 11:42 AM

                  So, you are saying failover from packet loss doesn't work?

                  How are you simulating packetloss?

                  1 Reply Last reply Reply Quote 0
                  • K
                    kathampy
                    last edited by Aug 16, 2013, 11:52 AM

                    Failover pased on a packet loss threshold does work. It works by default.

                    1 Reply Last reply Reply Quote 0
                    • K
                      kejianshi
                      last edited by Aug 16, 2013, 11:54 AM

                      If failover isn't working based on simulation of packet loss then:

                      Either its broken or

                      The settings are wrong or

                      Packet loss is not being done effectively to cause a failover.

                      Thats why I'm asking how are the packets being dropped.

                      1 Reply Last reply Reply Quote 0
                      • R
                        rober1sf
                        last edited by Aug 16, 2013, 11:57 AM

                        On router 1 in my diagram above, I have an outbound firewall rule that blocks all outbound Internet traffic, thus creating Internet packet loss on WAN 1. I know the packet loss is happening too because the pfSense diag ping tool will have 100% loss, but gateway status will still show it pinging.

                        In a "real" production setting, I would test this by removing the coax cable from the cable modem because simply unplugging the power to the modem would be link state down, which doesn't happen when the Internet goes down.

                        1 Reply Last reply Reply Quote 0
                        • K
                          kejianshi
                          last edited by Aug 16, 2013, 12:01 PM

                          Are you sure those packets you are blocking are being dropped silently and not rejected with a reply?

                          REJECT
                              Prohibit a packet from passing. Send an ICMP destination-unreachable back to the source host [unless the icmp would not normally be permitted, eg. if it is to/from the broadcast address].
                          DROP (aka DENY, BLACKHOLE)
                              Prohibit a packet from passing. Send no response.

                          1 Reply Last reply Reply Quote 0
                          • R
                            rober1sf
                            last edited by Aug 16, 2013, 12:04 PM

                            When I ping from the workstation behind the pfSense I get response timed out, 100% loss. I believe that is correct, right?

                            1 Reply Last reply Reply Quote 0
                            • K
                              kejianshi
                              last edited by Aug 16, 2013, 12:26 PM Aug 16, 2013, 12:12 PM

                              Do you own a server on the net anywhere? 
                              What I would do is maybe set up a couple Centos boxes with public IP you can ping.
                              Use those IPs as your monitor IPs.

                              If you shut down the Centos box (no blocking anything), then that will be for sure packet loss.
                              You and a buddy could set up one at your home and one at his if you want to have control over two "gateway" IPs to use.

                              I know this sounds like unnecessary work, and it may be, but at least you will know its not your method of inducing packet loss that is flawed.
                              I suppose you could do the same thing entirely in lab environment with no outside internet.

                              I don't know if pfsense would know the difference in a packet dropped silently, rejected, or an unreachable offline server. It might.
                              Since you didn't tell me if you are dropping packets silently, I assume you aren't sure.

                              1 Reply Last reply Reply Quote 0
                              • R
                                rober1sf
                                last edited by Aug 16, 2013, 1:21 PM

                                @kejianshi:

                                DROP (aka DENY, BLACKHOLE)
                                   Prohibit a packet from passing. Send no response.

                                I'm doing a DENY rule in the firewall. I don't think that I need to switch to pinging 2 of my own servers on the Internet (unless you are thinking about something that I'm not) because this setup works in the exact same setup with the Cisco RV042, and the RV042 fails over.

                                ![Router 1 Firewall Rule.JPG](/public/imported_attachments/1/Router 1 Firewall Rule.JPG)
                                ![Router 1 Firewall Rule.JPG_thumb](/public/imported_attachments/1/Router 1 Firewall Rule.JPG_thumb)

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kejianshi
                                  last edited by Aug 16, 2013, 1:28 PM

                                  When it works for others, but not for you, I'd suggest changing your methods or recheck your settings.  That would be a pretty big bug if it really doesn't work.

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    rober1sf
                                    last edited by Aug 16, 2013, 8:13 PM

                                    Ok, so I added a laptop on the same LAN as Router 1 (see attached Visio) and changed my monitor IP on WAN1 to that latptop's IP address. Physically unplugging the cable from the laptop keeps the physical link on WAN1 but allowed for packet loss and a failover to WAN2. Reconnecting the cable to the laptop allowed the pings to begin again and the connection to WAN1 was then automatically restore as well.

                                    WORKED like it should! Still confused by the Cisco RV042 worked with the other setup, but all I can say is that maybe the pfSense "sees" the pings differently from the Router 1 firewall block rule than the Cisco??

                                    At any rate, ready to try in a REAL production environment (see attached Visio for the "UNCOMPLICATED" network you all were looking for ;D ).

                                    Thanks to all for helping. If anyone stumbles across this and needs help, I've also created a step-by-step setup from initial boot/configuration to setup a Dual WAN with Failover… just PM me for a copy.

                                    Thanks again!!

                                    ![Dual WAN Test 2.jpg](/public/imported_attachments/1/Dual WAN Test 2.jpg)
                                    ![Dual WAN Test 2.jpg_thumb](/public/imported_attachments/1/Dual WAN Test 2.jpg_thumb)
                                    ![Production Dual WAN.jpg](/public/imported_attachments/1/Production Dual WAN.jpg)
                                    ![Production Dual WAN.jpg_thumb](/public/imported_attachments/1/Production Dual WAN.jpg_thumb)

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kejianshi
                                      last edited by Aug 16, 2013, 8:18 PM

                                      Yeah - I wasn't trying to waste your time.  I'm glad its working now. 
                                      I hope your actual install goes well also.

                                      1 Reply Last reply Reply Quote 0
                                      34 out of 34
                                      • First post
                                        34/34
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                        This community forum collects and processes your personal information.
                                        consent.not_received