Dual Wan traffic

tomli

Hi all,

In the pfsense, I set the default GW is 1.1.1.1 (1 st ISP). All the incoming traffic coming from 2 nd ISP are sent to the 1 st ISP for outgoing. Then the 1 st wan port will have high traffic load. I want to separate the traffic. Can pfsense support it?

Thanks,
Tom

KOM

You can use firewall rules to direct traffic to any gateway you have. Have you read any of the Multi-WAN guide? Gateway groups allow you to do load-balancing or failover automatically.

tomli

Hi,

Yes, I read it.

I tried to configure the rule in Lan Port to test it.

Interface: LAN
Protocol: Any
Source: Any
Desination: Any

Advanced features
Gateway: To Wan2

All the incoming traffic (1 or 2 wan port) are still using wan1 port for outgoing. It seem the rules cannot work properly.

Thanks,
Tom

Derelict

Incoming connections are going to use whatever IP address/interface DNS tells them to connect to.

All the firewall rules on LAN control are which WAN port to use for connections ORIGINATED from LAN hosts.

Return traffic for connections coming in from ISP1/ISP2 have to go out the same interface they came in on.

tomli

Hi All,

Attached is my network diagram for all reference.

Now, the pfense default GW is Router B IP address. Can pfsense return the traffic to use router A? My friend told me this is called "symmetric route" in the router technology.

Thanks,
Tom

netdia.jpg_thumb

heper

whats the point of router A & router B ? (might have missed something)

tomli

Sorry, what do you mean the point of route A and B?

Router A and B are connected to ISP A and B company. For example:

Router A Lan IP is 192.168.1.1
Router B Lan IP is 192.168.1.2
PFsense IP is 192.168.1.3 and the default GW is 192.168.1.2.

I want the incoming traffic from Router A . PFsense will send the outgoing traffic through the Router A too.

Thanks,
Tom

heper

well, why don't you connect your two isp's , directly to pfsense? putting 2 routers in front of pfSense(also a router), seems pointless.

also router A & router B have the same lan subnet (192.168.1.0/24) …. this is asking for trouble. you can not have multi-wan when you only have 1 WAN-interface on pfsense.
if you insist of going your double-nat way, i'd advise you to change your "lan' subnets on 1 of your routers to something different.

tomli

Hi,

I have one wan interface. Can I route the traffic for different IP? It is mean I can control the outgoing traffic to use which IP (NOT Default GW) for outgoing.

Thanks.

Derelict

What?

tomli

Hi,

In the Diagram, Client A use IE to browser our Web page.
Client A => Internet => RouterA=>PFSense => Web Server
Can PFSense return the data to the ClientA through RouteA?

In the Diagram, Client B use IE to browser our Web page.
Client B => Internet => RouterB=>PFSense => Web Server
Can PFSense return the data to the ClientB through RouteB?

Please advise.

Thanks.

NetDjpg.jpg_thumb

jahonix

Are Route-A and Route-B supposed to hit the same web-server?
How do you separate traffic TO your 3 web servers from schematic 1?

tomli

Hi,

Yes, Route-A and Route-B hit the same web-server.

ISP company route the traffic to our web server. (I cannot control it).

Thanks.

jahonix

Is that one web server or multiple as in your first drawing?

tomli

Hi all,

I try to add the below configuration in my /tmp/rule.debug file manually. It can work for me. But I don't know how to add it in GUI Would you mind teaching me?

User-defined rules follow

anchor "userrules/*"

pass in quick on $WAN reply-to { ( re0 192.168.5.22 ),(re0 192.168.5.21) } round-robin inet from any to any tracker 1436785528 keep state label "USER_RULE"

If we cannot add it in GUI, can I save it permanent?

Thanks.

Guest

Try out using "policy based routing" to manage the internal traffic.

The both routers are often able to work in the so called "bridged modus" only acting as a pure modem
(figure 1) ;)
If not, they can be the front line where the Web Server is standing behind inside a so called "dual homed DMZ"
(figure 2) ::)

To reach form the outside the Web Server it is even necessary to open and forward ports,
whatever then in normal the web server will not be placed inside the LAN, that you have to open
ports directly to the LAN, there for a DMZ will be created today thats the normal and also safe way.

tomli.jpg_thumb