<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Dual WAN Failover with Dual LAN]]></title><description><![CDATA[<p dir="auto">Howdy,</p>
<p dir="auto">I have had a dual-lan, single wan setup working correctly for a while.  I am now trying to implement an additional wan line for failover only (no loadbalancing at all).  I have gotten the 2nd wan interface working and the 2 loadbalance pools implemented (Wan1FailsToWan2 and Wan2FailsToWan1).  I have verified that the load balance pools are working by taking the wan1 down (the load balance status page shows wan1 off and wan2 on).</p>
<p dir="auto">I believe I am having an issue with my firewall rules.  For both LANs they my rules are directing to the gateway 'default'.  I have experimented with putting my loadbalance pools as the gateway but I have not been able to get it working.  I have also been using the documents I could find concerning multi-wan setups but they are usually for loadbalancing and single LANs.  The only real rules I have existing are to keep traffic between the 2 LANs separate outside of allowing LAN1 to a single IP address on LAN2.</p>
<p dir="auto">WAN1: 66.76.X.X (static)<br />
WAN2: DHCP (WAN2Verizon)</p>
<p dir="auto">LAN1: 192.168.0.X<br />
LAN2 (Public): 192.168.1.X</p>
<p dir="auto">WAN1FailsToWAN2 and WAN2FailsToWAN1.</p>
<p dir="auto">I have attached my sanitized configuration.  If someone could please help me out I would greatly appreciate it!</p>
<p dir="auto">Thanks,<br />
Alan<br />
<a href="/public/_imported_attachments_/1/config-sanitized.txt">config-sanitized.txt</a></p>
]]></description><link>https://forum.netgate.com/topic/10882/dual-wan-failover-with-dual-lan</link><generator>RSS for Node</generator><lastBuildDate>Sun, 14 Jun 2026 01:31:05 GMT</lastBuildDate><atom:link href="https://forum.netgate.com/topic/10882.rss" rel="self" type="application/rss+xml"/><pubDate>Sun, 14 Sep 2008 18:48:20 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Sat, 20 Sep 2008 09:38:06 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/coldfirex">@<bdi>Coldfirex</bdi></a>:</p>
<blockquote>
<p dir="auto">… For both LANs they my rules are directing to the gateway 'default'.  I have experimented with putting my loadbalance pools as the gateway but I have not been able to get it working.</p>
</blockquote>
<p dir="auto">This has to be the pool, otherwise it points the clients to one gateway only. And if that fails…</p>
<p dir="auto">In your posted config I saw rules originating on OPT1 to access gateway "Wan2 Failvoer..." and "Wan1 Failvoer..."<br />
I haven't seen those for LAN.</p>
<p dir="auto">To get it working you should start with a card blanc rule  &lt;allow* from*="" to*="" gateway:pool=""&gt;  on both your LAN IFs.</p>
<p dir="auto">I haven't setup a dual WAN config myself yet. These assumptions are from my understanding of how it should work...&lt;/allow*&gt;</p>
]]></description><link>https://forum.netgate.com/post/181909</link><guid isPermaLink="true">https://forum.netgate.com/post/181909</guid><dc:creator><![CDATA[jahonix]]></dc:creator><pubDate>Sat, 20 Sep 2008 09:38:06 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Fri, 19 Sep 2008 20:19:30 GMT]]></title><description><![CDATA[<p dir="auto">Anyone have a similar setup that could spare their config for comparison?</p>
]]></description><link>https://forum.netgate.com/post/181893</link><guid isPermaLink="true">https://forum.netgate.com/post/181893</guid><dc:creator><![CDATA[Coldfirex]]></dc:creator><pubDate>Fri, 19 Sep 2008 20:19:30 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Thu, 18 Sep 2008 12:41:36 GMT]]></title><description><![CDATA[<p dir="auto">It doesn't appear to still be working.  :(</p>
<p dir="auto">Could someone please post or PM me their sanitized config if they are running in a Failover setup (not load balanced)??</p>
]]></description><link>https://forum.netgate.com/post/181835</link><guid isPermaLink="true">https://forum.netgate.com/post/181835</guid><dc:creator><![CDATA[Coldfirex]]></dc:creator><pubDate>Thu, 18 Sep 2008 12:41:36 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 16:35:17 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/gruensfroeschli">@<bdi>GruensFroeschli</bdi></a>:</p>
<blockquote>
<p dir="auto">Did you do this traceroute test from pfSense itself?<br />
When WAN1 is down: are you able to ping the gateway of WAN2 from pfSense itself?</p>
<p dir="auto">pfSense does not use the balancing pool for traffic origination on itself.<br />
–&gt; That's why you need static routes if you want to force some traffic to the second WAN (like DNS-queries).</p>
</blockquote>
<p dir="auto">I tried from a laptop connected to the network, not pfsense itself.  I completely forgot to try to ping WAN2's gateway, simply an external IP.</p>
]]></description><link>https://forum.netgate.com/post/181686</link><guid isPermaLink="true">https://forum.netgate.com/post/181686</guid><dc:creator><![CDATA[Coldfirex]]></dc:creator><pubDate>Tue, 16 Sep 2008 16:35:17 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 14:22:50 GMT]]></title><description><![CDATA[<p dir="auto">Did you do this traceroute test from pfSense itself?<br />
When WAN1 is down: are you able to ping the gateway of WAN2 from pfSense itself?</p>
<p dir="auto">pfSense does not use the balancing pool for traffic origination on itself.<br />
–&gt; That's why you need static routes if you want to force some traffic to the second WAN (like DNS-queries).</p>
]]></description><link>https://forum.netgate.com/post/181683</link><guid isPermaLink="true">https://forum.netgate.com/post/181683</guid><dc:creator><![CDATA[GruensFroeschli]]></dc:creator><pubDate>Tue, 16 Sep 2008 14:22:50 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 14:15:22 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/gruensfroeschli">@<bdi>GruensFroeschli</bdi></a>:</p>
<blockquote>
<p dir="auto">Sorry a typo.<br />
I meant: Currently it seems you push per DHCP the DNS-servers 208.180.42.100 and 208.180.42.68 directly to the clients.<br />
–&gt; The clients access the DNS-server directly.</p>
<p dir="auto">Just delete the DNS-server fields on the DHCP-server config.<br />
--&gt; Clients will use pfSense as their DNS-server</p>
<p dir="auto">If you add the static route for the DNS-server on pfSense, pfSense will be able to resolve names even if one WAN is down.<br />
If you modify the config.xlm manually you can also add a tertiary and a quaternary DNS server --&gt; 2 for each WAN. --&gt; 2 static routes pointing to the second WAN.</p>
</blockquote>
<p dir="auto">Ah, thanks for clarification.<br />
Concerning "Would this help as I was not able to even ping or perform a traceroute when I took down WAN1?".  What I meant to say is would this help as can not ping or traceroute an external IP address (with DNS out of the loop)?</p>
]]></description><link>https://forum.netgate.com/post/181681</link><guid isPermaLink="true">https://forum.netgate.com/post/181681</guid><dc:creator><![CDATA[Coldfirex]]></dc:creator><pubDate>Tue, 16 Sep 2008 14:15:22 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 13:55:52 GMT]]></title><description><![CDATA[<p dir="auto">Sorry a typo.<br />
I meant: Currently it seems you push per DHCP the DNS-servers 208.180.42.100 and 208.180.42.68 directly to the clients.<br />
–&gt; The clients access the DNS-server directly.</p>
<p dir="auto">Just delete the DNS-server fields on the DHCP-server config.<br />
--&gt; Clients will use pfSense as their DNS-server</p>
<p dir="auto">If you add the static route for the DNS-server on pfSense, pfSense will be able to resolve names even if one WAN is down.<br />
If you modify the config.xlm manually you can also add a tertiary and a quaternary DNS server --&gt; 2 for each WAN. --&gt; 2 static routes pointing to the second WAN.</p>
]]></description><link>https://forum.netgate.com/post/181675</link><guid isPermaLink="true">https://forum.netgate.com/post/181675</guid><dc:creator><![CDATA[GruensFroeschli]]></dc:creator><pubDate>Tue, 16 Sep 2008 13:55:52 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 13:20:14 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/gruensfroeschli">@<bdi>GruensFroeschli</bdi></a>:</p>
<blockquote>
<p dir="auto">As far as i can see from your config your DHCP clients use the DHCP directly.<br />
1: Remove this and let the pfSense DNS-forwarder be the DNS-server for your clients.<br />
2: Add a static route for one of your DNS-server entries on pfSense to the second WAN so pfSense is still able to resolve names when the primary WAN goes down.</p>
</blockquote>
<p dir="auto">1. If you mean that pfSense is acting as the DHCP server then yes it is.  Or are you talking about my ISP dhcp?<br />
2. I will make this change.<br />
Would this help as I was not able to even ping or perform a traceroute when I took down WAN1?</p>
]]></description><link>https://forum.netgate.com/post/181673</link><guid isPermaLink="true">https://forum.netgate.com/post/181673</guid><dc:creator><![CDATA[Coldfirex]]></dc:creator><pubDate>Tue, 16 Sep 2008 13:20:14 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 13:50:39 GMT]]></title><description><![CDATA[<p dir="auto">As far as i can see from your config your DHCP clients use the DNS-server directly.<br />
1: Remove this and let the pfSense DNS-forwarder be the DNS-server for your clients.<br />
2: Add a static route for one of your DNS-server entries on pfSense to the second WAN so pfSense is still able to resolve names when the primary WAN goes down.</p>
]]></description><link>https://forum.netgate.com/post/181669</link><guid isPermaLink="true">https://forum.netgate.com/post/181669</guid><dc:creator><![CDATA[GruensFroeschli]]></dc:creator><pubDate>Tue, 16 Sep 2008 13:50:39 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 13:04:12 GMT]]></title><description><![CDATA[<p dir="auto"><a class="plugin-mentions-user plugin-mentions-a" href="/user/gruensfroeschli">@<bdi>GruensFroeschli</bdi></a>:</p>
<blockquote>
<p dir="auto">Could you describe what your actual problem is?<br />
As in: what do you want and how does it differ from what you have.</p>
</blockquote>
<p dir="auto">The issue is that while the Load Balance pools are working, I am unable to reach the Internet when it fails to WAN2.  I believe this is due to my firewall rules, but am not sure.</p>
]]></description><link>https://forum.netgate.com/post/181668</link><guid isPermaLink="true">https://forum.netgate.com/post/181668</guid><dc:creator><![CDATA[Coldfirex]]></dc:creator><pubDate>Tue, 16 Sep 2008 13:04:12 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 06:01:46 GMT]]></title><description><![CDATA[<p dir="auto">Could you describe what your actual problem is?<br />
As in: what do you want and how does it differ from what you have.</p>
]]></description><link>https://forum.netgate.com/post/181650</link><guid isPermaLink="true">https://forum.netgate.com/post/181650</guid><dc:creator><![CDATA[GruensFroeschli]]></dc:creator><pubDate>Tue, 16 Sep 2008 06:01:46 GMT</pubDate></item><item><title><![CDATA[Reply to Dual WAN Failover with Dual LAN on Tue, 16 Sep 2008 02:23:45 GMT]]></title><description><![CDATA[<p dir="auto">Any advice?</p>
]]></description><link>https://forum.netgate.com/post/181648</link><guid isPermaLink="true">https://forum.netgate.com/post/181648</guid><dc:creator><![CDATA[Coldfirex]]></dc:creator><pubDate>Tue, 16 Sep 2008 02:23:45 GMT</pubDate></item></channel></rss>