Assigning WAN / Internet Gateway to Specific VLAN

[dnet]

Hello All,

I'm having trouble understanding how to assign a particular WAN (Internet) Gateway to a Specific VLAN. Essentially, I have a multi tenant setup and need to dedicate their internet connection coming in to pfsense through one of the network ports assigned as a WAN interface to their designated VLAN on the network. VLAN Tagging, etc is working correctly on our network and I'm down to this last step. I've tried exploring manually putting in the gateway / the gateway doesn't appear under the DHCP Server option for the designated VLAN. Any ideas? Perhaps I'm going about this the wrong way.

Example:

Gateways -

Internet WAN for Company A - SET AS DEFAULT GATEWAY in PFSENSE
Internet WAN for Company B - NEED TO DESIGNATE FOR VLAN 3

VLAN 2- Class C DHCP - 10.1.2.x -
VLAN 3 - Class B DHCP - 172.16.0.X -  Because of the amount of users on the network this is a class B DHCP.

Thanks for your time!

[johnpoz]

"VLAN 3 - Class B DHCP - 172.16.0.X -  Because of the amount of users on the network this is a class B DHCP. "

Really you have something close to 65k users? ;)

If you want a specific network to use a specific gateway just assign that in your rules on that interface.  Now all their traffic is forced out that gateway.  Do you want them to be able to use wan 1 if wan 2 is down?  What is wan 1 is down do you want the wan 1 users to use wan 2?

If you want any users to access other things like dns on pfsense or other vlans/networks on pfsense then you put those rules above the rule that forces them out the specific gateway.

Here I changed my dmz network, nothing currently on in that network.. So I went under the rule that allows it internet access, ie the ! rfc1918 allow rule - so edit the rule expand the advanced section and go down to the gateway and change to your specific wan gateway.

Now clients in this network can ping pfsense, they can use pfsense for dns since those rules are above the any any with gateway rule.  But if they want to to an internet IP, ie not rfc1918 address then they would go out that specific gateway

[dnet]

That makes sense! For some reason it didn't cross my mind to create rules in the firewall. Thank you for the help!

;D It's the idea roughly 65k address could be assigned that counts. :)  DHCP is set to hand out much less, but I needed around 3,000 or so.  Complete Cisco Network, with the exception of PFSense. :)

[johnpoz]

Your putting 3000 on the same broadcast domain.. That is a lot of broadcast traffic ;)

/20 gives 4k users, which 1000 more than you say you would need..

To me /22 would be highest I would ever think of using for a segment with machines that would be broadcasting.  Window machines are chatty freaking things!!!  They like to send a lot of broadcast and multicast traffic out of the box..