2 wans - how to direct traffic to each ?
-
Can OPT1 ping its gateway? 192.168.1.1
-
yes
-
Do you have an upstream gateway defined for OPT1?
-
thanks I read the multi wan but it inst relevant as I don't want fail over or load-balancing.
…Actually, it IS still relevant. You need to make sure you follow the directions for multi wan, including setting gateways for each, dns for each, and so on.
The only step that isn't necessary since you do not want failover or load balancing is setting up "Gateway Groups".
That way traffic will always use your default gateway, UNLESS specified to use the other gateway in your firewall rules.
I hope this helps,
-Alan
-
@KOM:
Do you have an upstream gateway defined for OPT1?
yes, the router IP and it can be pinged per my earlier screen shot.
I still can't see why pfsense is stopping traffic on OPT1.
Very frustrating.
-
Can you post a screen shot of the fw rules for Lan & OPTx.
Have you tried creating rules for OPTx to block what you dont want OPTx devices to connect to, then as the last rule create a allow everything rule. By this I mean its any to any not an any to WAN net or any to WAN address.
If you want to stop your OPTx devices from connecting to the fw, if you use DHCP pf will create a rule for the DHCP server automatically, but you will need to create a rule to allow access to the DNS (53) but immediately below that you can do a block rule for everything to the OPTx interface ip address to stop devices from connecting to anything else in the fw.
That should get you out on the OPTx interface, even if you add block rules to WAN net and WAN address before the allow everything!
-
here are the rules,
-
I'm not seeing anything are the images hosted outside of pfsense.org?
-
imgur
-
Yeah I saw them from another machine. Anyway this works on pfsense 2.2.2 and I'm not running multiple wans just one connection through a modem in bridge mode so I'm handling the ppoe username & password connection settings in pfsense which is passed out of the wan to the modem router running in bridged mode.
I've done a screen shot of some OPTx rules which work for me see attached. I've drawn a box around the gateway of the first rule, if you want to force traffic through a particular gateway as you have two connections you could try the gateway option which is a button at the bottom of the edit rule page.
You might also note I have two rules to block WAN net and WAN address but these dont work so ignore them.
The rules work from the top to the bottom and everything is a default deny but I prefer having explicit blocks in place just to be sure, on other interfaces I even explicitly allow individual ports for individual machines to really lock everything down and then I can see if anything has found a new way of communicating like passing messages in say netbios or other tricks.
See if the screen shot gives you any ideas for your own set up.
-
thanks for that.
The issue I have is, OPT1 cannot ping any host on the internet. It DOES resolve the name and I can ping if I connect to the router.
Until I can fix this issue nothing else is going to work.
I can't see where pfsense is blocking OPT1 from pinging any internet host.
-
So… your ISP DNS on WAN is the gateway on OPT? I don't think this is particularly sane... How many levels of NAT are you behind?
Also, WTH is the pfSense version used here? Most of this configuration stuff does not exist on 2.1.x, nor on 2.2.x; plus copyright 2004 - 2009. :o ::)
