Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sticky connections not working with dual WAN

    Scheduled Pinned Locked Moved Routing and Multi WAN
    65 Posts 7 Posters 11.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      netblues @TheCableGuy96
      last edited by

      @Daskew78 You shouldnt really care about states being closed when you have a stickiness of 1200.

      As documentation says, if you have stickiness 0, then load balancing path is re evaluated when connectios are closed. (and we could discuss if this means fin wait etc)
      But stickiness of 1200 Means 1200 seconds AFTER connections is closed, if a new request comes from the same ip to the same host it will leave from the same gateway.

      I insist. stickiness works fine on multiwan ssl load balancing scenario.
      And consider this workaround too
      https://redmine.pfsense.org/issues/6025

      quoting
      Also of note, when the weights differ, even though the gateways have a specific order with repetition in the rule, pf seems to still flip back and forth, though the general ratio of the weights is respected. For example with WAN1=3, WAN2=2:

      I had the same issues as you do until I made 2 the default weight on both load balancing connections.

      Deeper issues are suspected, as redmine says.
      Please consider testing the workaround.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Yeah sure seems that issue is exactly what your seeing... I would do what @netblues says and that should fix up your issue I would hope.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • TheCableGuy96T
          TheCableGuy96
          last edited by

          @netblues @johnpoz

          Thanks guys... I've had a read through but it's all a little confusing to me.

          Can you just clarify you are suggesting setting both connections to "Tier 2" instead of "Tier 1" on the LoadBalancing profile?

          Cheers.

          N 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Yup..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • TheCableGuy96T
              TheCableGuy96
              last edited by

              Well if that's the case it is a bug then. But at least there appears to be a workaround.

              I'll test it now, cheers again :)

              1 Reply Last reply Reply Quote 0
              • N
                netblues @TheCableGuy96
                last edited by

                @Daskew78 nope
                We suggest to put a weight of 2 on both gateways and load balance them as both tier 1.
                with a stickiness of 2500

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  As you see yes there is a redmine on it ;)

                  Currently targeted at 2.5 - but its been pushed many times already.. So wouldn't expect... This thread could get added to that redmine I would think.. Might put a bit more weight on looking into it.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • TheCableGuy96T
                    TheCableGuy96
                    last edited by

                    Sorry I spoke a little too soon.... should I also set the sticky connections back to "0"?

                    N 1 Reply Last reply Reply Quote 0
                    • N
                      netblues @TheCableGuy96
                      last edited by netblues

                      @Daskew78 NO, it won't work on web banking sites

                      1 Reply Last reply Reply Quote 0
                      • TheCableGuy96T
                        TheCableGuy96
                        last edited by

                        Sorry I was replying too fast and missed your update about setting the states to 2500.

                        I have set it to 2500 and set each gateway to Tier 1 but I can't see where I set a weight of 2? Where is the weight setting?

                        1 Reply Last reply Reply Quote 0
                        • RicoR
                          Rico LAYER 8 Rebel Alliance
                          last edited by

                          System > Routing > Edit Gateway > Display Advanced > Weight

                          -Rico

                          1 Reply Last reply Reply Quote 0
                          • TheCableGuy96T
                            TheCableGuy96
                            last edited by

                            ahhh thank you.... i'm testing now... will update shortly :)

                            1 Reply Last reply Reply Quote 0
                            • N
                              netblues
                              last edited by

                              Remember to clear states and source tracking.

                              1 Reply Last reply Reply Quote 0
                              • TheCableGuy96T
                                TheCableGuy96
                                last edited by

                                Yeah I cleared both, closed all browsers and tried again on 2 personal servers with single IPs and banking but it's still happening.

                                I must admit it doesn't seem to be happening as much but it is still happening.

                                1 Reply Last reply Reply Quote 0
                                • N
                                  netblues
                                  last edited by

                                  I also see that you have default gateway on a load balancing group.
                                  Try to put default gateway to a failover group, (or just one of the lines).

                                  It is not recommended to do that.

                                  Also, for debug purposes, make a policy routing just for https and put it ahead of general load balancing rule, and redirect traffic to another load balancer (with the same members)
                                  So as to make sure https traffic is not mixed with anything else and retest.

                                  1 Reply Last reply Reply Quote 0
                                  • TheCableGuy96T
                                    TheCableGuy96
                                    last edited by

                                    Okay i'll have to get back to you tomorrow as I have to go out now.

                                    Thanks buddy :)

                                    1 Reply Last reply Reply Quote 0
                                    • TheCableGuy96T
                                      TheCableGuy96
                                      last edited by

                                      @netblues Sorry for the delay I was busy yesterday...

                                      I just want to check we are on the same page here:
                                      "I also see that you have default gateway on a load balancing group. Try to put default gateway to a failover group, (or just one of the lines)."

                                      Are you referring to the firewall rules defining the gateway for each vLAN or the section in "System > Routing > Default Gateway"?

                                      Also, I'm sorry but I don't understand what you mean when you say:
                                      "Also, for debug purposes, make a policy routing just for https and put it ahead of general load balancing rule, and redirect traffic to another load balancer (with the same members)"

                                      Please could you elaborate a little more what you are suggesting?

                                      Many thanks pal :)

                                      N 1 Reply Last reply Reply Quote 0
                                      • N
                                        netblues @TheCableGuy96
                                        last edited by

                                        @Daskew78 said in Sticky connections not working with dual WAN:

                                        @netblues Sorry for the delay I was busy yesterday...

                                        I just want to check we are on the same page here:
                                        "I also see that you have default gateway on a load balancing group. Try to put default gateway to a failover group, (or just one of the lines)."

                                        Are you referring to the firewall rules defining the gateway for each vLAN or the section in "System > Routing > Default Gateway"?

                                        Yes..

                                        Also, I'm sorry but I don't understand what you mean when you say:
                                        "Also, for debug purposes, make a policy routing just for https and put it ahead of general load balancing rule, and redirect traffic to another load balancer (with the same members)"

                                        Please could you elaborate a little more what you are suggesting?

                                        see here
                                        49aea2b4-988e-440c-8879-d25fd14b03c6-image.png

                                        Many thanks pal :)

                                        ssl failover load balances first and failovers if both lines are not availabie
                                        7fbb4568-3747-4f36-be55-7c3d36252140-image.png

                                        so we just make sure https traffic is handled by policy rule.
                                        You can also log packets if needed.

                                        1 Reply Last reply Reply Quote 0
                                        • TheCableGuy96T
                                          TheCableGuy96
                                          last edited by

                                          @netblues Okay "System > Routing > Gateways > Default gateway IPv4" is now set to WAN1 rather than a LoadBalancing profile.

                                          I think I understand you with the rule but I need to set up the gateway group to assign it to before I can and this is where I'm still a little hazy.

                                          Am I selecting one of the gateways in here or both? and what "Tier" and "Trigger Level" please? This is what I have currently but not sure if it's what you are suggesting?

                                          screenshot-pfsense.daveaskew.com_10445-2020.06.10-11_56_40.png

                                          Thanks.

                                          N 1 Reply Last reply Reply Quote 0
                                          • N
                                            netblues @TheCableGuy96
                                            last edited by

                                            @Daskew78 call it ssL_loadbalance so as not to be confused.
                                            put both lines as tier1
                                            and make trigger level member down, to be on the safe side, while testing.

                                            And do check you have weights set to 2 in routing gateways for both wan1_pppoe and wan2_dhcp

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.