Floating rules and outbound routing
-
A pfsense installation has two WAN interfaces, WAN1 (default gateway) and WAN2, and I need to whitelist inbound traffic from IP address A.B.C.D.
Web services use WAN1 and email services use WAN2.So, I create a floating rule for WAN1 and WAN2, which allows incoming traffic from the A.B.C.D. address. The A.B.C.D client tries to access www.domain.com, packets arrive on WAN1 and all is well. The same client tries to access mail.domain.com, packets arrive on WAN2, but instead of leaving from WAN2 they leave from WAN1 (the default gateway), and of course communication fails.
If I create the same rule on interfaces WAN1 and WAN2 as a standard rule (not floating), packets coming in from WAN1 get replies going out from WAN1 and packets coming in from WAN2 get replies going out from WAN2. So, there must be something that makes floating rules ignore the incoming interface when replying.
Does anybody know why this happens?
-
https://forum.pfsense.org/index.php?topic=78480.msg428354#msg428354