Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1 WAN for General use, 1 WAN for paid use

    Scheduled Pinned Locked Moved Routing and Multi WAN
    18 Posts 5 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R Offline
      Reiner030
      last edited by

      This sounds mostly like a special implementation of Captive Portal usage ;)

      1 Reply Last reply Reply Quote 0
      • C Offline
        css.josh
        last edited by

        OK, I'll stop speaking in general terms and get more specific.

        The first attachment is a crude network diagram.

        The second attachment is a screen shot of the firewall rules I'm trying out.

        I'm trying to push all traffic from 10.0.0.101 through WAN2 (as a demo "paid user") and then I leave the general rule to allow all other traffic through WAN1…

        To test it out, I have a simple PHP script on a local web server..

        Which simply prints what IP address each computer is using to get out the Gateway… They both seem to still be using the WAN1 IP address..?

        diagram.jpg
        diagram.jpg_thumb
        fwrules.jpg
        fwrules.jpg_thumb

        1 Reply Last reply Reply Quote 0
        • DerelictD Offline
          Derelict LAYER 8 Netgate
          last edited by

          And what about that isn't working?

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • C Offline
            css.josh
            last edited by

            Again, they both still seem to be using WAN1's IP address… If the one computer were using WAN2, shouldn't it show that IP address?

            1 Reply Last reply Reply Quote 0
            • DerelictD Offline
              Derelict LAYER 8 Netgate
              last edited by

              Are you sure the APs are APs and not Routing/NAT themselves?

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • DerelictD Offline
                Derelict LAYER 8 Netgate
                last edited by

                How are you routing to the local web server running the PHP script?  If it's behind pfSense with the clients, that rule is never applied.

                Try www.wimi.com instead.

                You realize that your NAT AP 1 rule is never applied because the rule above it always matches right?

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • C Offline
                  css.josh
                  last edited by

                  The local web server with the PHP script is not behind the pfSense router.

                  I just removed the NAT rule all together if you think it was being a problem, but it's still not working.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD Offline
                    Derelict LAYER 8 Netgate
                    last edited by

                    Something is not as it is being presented then.

                    Set the rule for packets with a 10.0.0.101 source address to log and check the firewall logs.

                    If nothing shows up, do the same with the default any any rule.

                    Check the state table and state summary to see what's being created.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • G Offline
                      georgeman
                      last edited by

                      Flush state table before testing!

                      If it ain't broke, you haven't tampered enough with it

                      1 Reply Last reply Reply Quote 0
                      • C Offline
                        css.josh
                        last edited by

                        @Derelict:

                        Something is not as it is being presented then.

                        Set the rule for packets with a 10.0.0.101 source address to log and check the firewall logs.

                        If nothing shows up, do the same with the default any any rule.

                        Check the state table and state summary to see what's being created.

                        After logging it and checking the current traffic graphs, I have confirmed that it is working properly! Thanks!

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.