Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Using pfsense to forward all traffic to another pfsense

    Scheduled Pinned Locked Moved Routing and Multi WAN
    7 Posts 4 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      spyshagg
      last edited by

      Hello

      Originally I had:

      WAN -> Draytek router -> small Switch -> PFSENSE 1 ->  LAN  (high avail)
                                                                  -> PFSENSE 2 -> LAN    (high avail)

      I was dual NATING but it worked fine and I actually preferred having it.

      I was forced to remove the Draytek, and now I have:

      WAN    -> PFSENSE1 -> LAN  (high avail)
      empty  -> PFSENSE2 -> LAN  (high avail)  (I have to manually plug the WAN cable into PFSENSE2 when PFSENSE1 box fails)

      What I want to have again is a router after the WAN cable and before PFSENSE1/2, so I can have true high availability.

      I was thinking on using another PFsense box for the router.

      WAN -> PFSENSE ROUTER -> small switch -> PFSENSE1 -> LAN  (high avail)
                                                                      -> PFSENSE2 -> LAN  (high avail)

      I tried this method above, and everything worked, except Dual Nating.  I could not open ports from PFSENSE ROUTER -> PFSENSE1 -> LAN client.

      Whats the best way to go at this?

      I also need PFSENSE ROUTER to preserve the manual Outbound static ports defined on PFSENSE1 for voip calls to work.

      1 Reply Last reply Reply Quote 0
      • V
        viragomann
        last edited by

        Why don't you connect the switch to WAN directly? If you do so you can drop out one point of failure.

        1 Reply Last reply Reply Quote 0
        • S
          spyshagg
          last edited by

          @viragomann:

          Why don't you connect the switch to WAN directly? If you do so you can drop out one point of failure.

          Because CARP requires 3 addresses and my ISP only provides /30 on their subnet.

          1 Reply Last reply Reply Quote 0
          • V
            viragomann
            last edited by

            There is no need for the 3 addresses to be in the same subnet since version 2.2. You may set the interface addresses to a private subnet.

            However, this solution prevents the backup box from accessing the internet and getting updates, cause this require the unique public IP which is occupied by the master. I don't know, if there is a workaround for that, otherwise you will have to switch the master box in "CARP maintenance mode" for updates.
            However, fail-over would go automatically, so for me this would be the better solution.

            1 Reply Last reply Reply Quote 0
            • S
              spyshagg
              last edited by

              The inside boxes are running 2.1.5.

              Either way, I am looking for the best way to pass all traffic from the PFsense router -> PFsense1. Dual-nating or DMZ? how to make a DMZ? isn't DMZ a port forwarding of all traffic instead of just one port?

              Because my previous test of dual nating a single port failed, and I am wondering what could possibly be happening or if there is something I dont know about.

              Dual nating worked well with draytek -> Pfsense1

              1 Reply Last reply Reply Quote 0
              • B
                basupriyapaul
                last edited by

                You can enable UPnP, and try out. In most cases, it works.

                1 Reply Last reply Reply Quote 0
                • A
                  akiraishere
                  last edited by

                  I have a simular question, I just want to use both at the same time and have both access each others LAN (both have the same multiple VLAN interfaces)

                  Yukimi Kazari @ Academy City Research

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.