2 gateways with the same wan



  • hi to all, I have my pfsense with 2 Network cards (LAN and WAN), but I have 2 gateways in my ISP network then I configured that in pfsense, my question is, ¿I can configure 2 ip ranges each one with one gateway? example 192.168.2.10 to 192.168.2.100 with gateway1, and 192.168.2.101 to 192.168.2.200 eith gateway2, I know this can be donde with 3 networks cards (2 Wan (each with one gateway) and 1 LAN), but i must do only with 2 cards, somebody can help me?



  • What is the point of what you're doing?  You typically use multi-WAN for load-balancing or failover.  Having one NIC to one ISP, even if that ISP has multiple gateways, accomplishes neither.



  • @KOM:

    What is the point of what you're doing?  You typically use multi-WAN for load-balancing or failover.  Having one NIC to one ISP, even if that ISP has multiple gateways, accomplishes neither.

    Becasue one gateway gave me 100mbps (It's the one I use by default), and the another only gave me 3mbps but I want use this only when the other gateway doens work, only for the most important machines



  • Do you have a second account with your ISP and you have two connections, not just two gateways?

    I don't have a multi-WAN config, but you can go to System - Routing and add additional gateways.  You can create gateway groups that will handle failover.  Finally, you use firewall rules to control which gateway traffic goes to.  Just be careful to not end up with an asymmetrical routing problem.



  • @KOM:

    Do you have a second account with your ISP and you have two connections, not just two gateways?

    I don't have a multi-WAN config, but you can go to System - Routing and add additional gateways.  You can create gateway groups that will handle failover.  Finally, you use firewall rules to control which gateway traffic goes to.  Just be careful to not end up with an asymmetrical routing problem.

    I explain you, is only one subnet, if a put gateway1 in a machine that machine will have a internet conection fo 100mbps, if I put the gateway2 that machine only will have 3mbps, the only change is the gateway, the subnet is alwaays the same, I already have the gateways in Routing, I have in default the gateway with 100mbps, but I dont know exactly how make the rules for do the range of each gateway, u can give a example? I had thought it could be done in System\Routing\Static Routes but I think this is only for one IP not for a range



  • but I dont know exactly how make the rules for do the range of each gateway

    Under a firewall rule's Advanced options, you will see a Gateway picklist that lets you select which gateway that rule's traffic goes out on.  Create aliases for your two groups and then use that aliases as the Source in your LAN rules.



  • @KOM:

    but I dont know exactly how make the rules for do the range of each gateway

    Under a firewall rule's Advanced options, you will see a Gateway picklist that lets you select which gateway that rule's traffic goes out on.  Create aliases for your two groups and then use that aliases as the Source in your LAN rules.

    hello there,

    I have almost same isssue than topic starter… Except I want to use 2nd gateway for specific subnet (actually for DMZ).
    So I use default gateway for LAN interface, and in firewall rule for DMZ interface I put in advanced options to use my 2nd gateway of wan, but when I go on internet, my traffic still outbound from 1st default gateway, as servers from LAN does.

    I have AUTOMATICLY NAT option. Should I change it?



  • @KOM:

    but I dont know exactly how make the rules for do the range of each gateway

    Under a firewall rule's Advanced options, you will see a Gateway picklist that lets you select which gateway that rule's traffic goes out on.  Create aliases for your two groups and then use that aliases as the Source in your LAN rules.

    I think this rule affect the routing gateway , I need affect the upstream gateway (The one in the WAN configuration)



  • I think this rule affect the routing gateway , I need affect the upstream gateway (The one in the WAN configuration)

    What do you mean by routing gateway vs upstream gateway?  All gateways are upstream.

    I have AUTOMATICLY NAT option. Should I change it?

    No idea.  Start your own thread and post screenshots of your DMZ rules and multi-WAN config if you want someone to help you.



  • @KOM:

    I think this rule affect the routing gateway , I need affect the upstream gateway (The one in the WAN configuration)

    What do you mean by routing gateway vs upstream gateway?  All gateways are upstream.

    I dont think so,I will try to explain you with this diagram



  • I'm sorry but your network diagram is even more confusing to me.  Why do you have 4 routers and 4 PCs?  What are all these things connected to?


  • Banned



  • Tell me about it.  It's starting to make my head hurt.



  • @KOM:

    Tell me about it.  It's starting to make my head hurt.

    is the same pfsense with 4 different configurations, and the pc with the result of that configurations


  • Rebel Alliance Global Moderator

    WTF does upstream gateway 2, routing gateway 1 mean???

    Its gibberish…

    When they asked you to draw, they meant how your connected to what gateway 1 and gateway 2 is..



  • @johnpoz:

    WTF does upstream gateway 2, routing gateway 1 mean???

    Its gibberish…

    When they asked you to draw, they meant how your connected to what gateway 1 and gateway 2 is..

    my ISP provide me 2 gateways, in my pfsense I have 2 network cards (WAN and LAN), I have the 2 gateways configured in pfsense, my diagram only show what happen  with that 4 configurations (exchanging the gateways between upstream default and routing gate way), I only have one pc  in the pfsense LAN for see the results


  • Rebel Alliance Global Moderator

    And what is the point of giving you 2 gateways on the same connection?



  • @johnpoz:

    And what is the point of giving you 2 gateways on the same connection?

    I explain it, in the third post


  • Rebel Alliance Global Moderator

    that doesn't explain the POINT of it.. You only have 1 connection???  If the connection is down then both gateways would not be reachable!!  So does their gateway 1 go down while you still have a connection??  WTF???

    And while on this second gateway you only get 3mbps from a 100mbps connection..  that is not really a failover or backup ;)

    So they gave you this 2nd gateway and said use this is a backup?  Because our primary router goes down??

    I see zero point to this sort of setup..  Point to the gateway that gives you 100mbps and call it a day..  If your internet goes down - try changing over to the other.. Does that work??  If so call the the ISP and say WTF!!!



  • 1. You are Wrong, I Dont know how is the ISP configuration but sometimes the 100mbps is down, then I can change the most important pc to another network (only changing the gateway)

    2.  I dont want failover, I know 3mbps is not enough for a network, is only for a few machines

    3. Yes

    4. Yes that Work, my ISP provide me from a fortinet, I cant see anything of that configuration and obvious I cant change anything of that

    Then you can help me, with the configuration that I want?


  • Banned

    I should have purchased more popcorn…

    @Alucardko:

    1. You are Wrong, I Dont know how is the ISP configuration but sometimes the 100mbps is down, then I can change the most important pc to another network (only changing the gateway)

    Wonderful. So, perhaps the ISP could implement a failover on their own infrastructure, instead of suggesting their customers to configure similar WTFs?!



  • I don't think what you are trying to do is possible without another NIC, and at this point I am stepping back.


  • Banned

    Well you could create 2 VLANs on your WAN and keep on messing with this nonsense, but I'd rather switch ISPs.



  • I ask to my ISP about how exactly work my service, I will try explain you MY isp have 2 contracts, with 2 companies (one 100mbps, another 3mbps), then they have connected the 2 services to a fortinet, then they make my subnet 192.168.17.xx that subnet have 2 gateways (100mbps and 3bmps) then I can use any of that services, only changing the gateways


  • Banned

    @Alucardko:

    have 2 contracts, with 2 companies (one 100mbps, another 3mbps), then they have connected the 2 services to a fortinet

    Good that we know now, after two days of asking you to produce a network scheme.  ::) ::) ::) Once you've asked both ISPs about how each of their services should be configured, got rid of the Fortinet and plugged both to pfSense box, you might even get a working pfSense multi-WAN setup.



  • @doktornotor:

    @Alucardko:

    have 2 contracts, with 2 companies (one 100mbps, another 3mbps), then they have connected the 2 services to a fortinet

    Good that we know now, after two days of asking you to produce a network scheme.  ::) ::) ::) Once you've asked both ISPs about how each of their services should be configured, got rid of the Fortinet and plugged both to pfSense box, you might even get a working pfSense multi-WAN setup.

    I cant change anything in the fortinet, they only gave me one  ethernet  wire with the service, I do not even know where the fortinet is physically


  • Banned


  • Rebel Alliance Global Moderator

    So your connection comes in from a fortinet..  And this fortinet has 2 different connections..  Why would the fortinet not be set to use this 2nd connection if 1st fails?

    That is how any sane person would set it up.. Expecting the customer to use 2 different gateways on the same network is moronic…

    Good luck...



  • @johnpoz:

    So your connection comes in from a fortinet..  And this fortinet has 2 different connections..  Why would the fortinet not be set to use this 2nd connection if 1st fails?

    That is how any sane person would set it up.. Expecting the customer to use 2 different gateways on the same network is moronic…

    Good luck...

    Because 3mbps is not enough for a network, but ok, I'm going to a corner to cry jeje


  • Rebel Alliance Global Moderator

    how are you suppose to know the 1st connection went down??  You would not loose an interface, etc.  So how do you cut over automatically?  you would have to setup some monitor to some outside IP..

    Their fortinet interface most likely would go down if the ISP goes down for that connection, etc.

    No shit 3mbps is not enough..  but as a failover/backup its better than ZERO..  But if they are bringing these into a fortinet, and then just handing you 1 connection, why should you as the customer have to figure out when to fail over?  If it was your fortinet ok, but your saying its this companies…  So they should figure out the failover and hand you your 1 connection that you use..



  • well, Then it is not possible to do what I said? (2 ip ranges, one with one gateway and the other with the other gateway? jeje)


  • Rebel Alliance Global Moderator

    Depending on what you want to do..

    You would have to create a monitor for your default gateway that goes somewhere outbound and not just your gateway address which is the default.  You then have another gateway setup that uses your other gateway 2 address.

    You shouldn't have to jump through these hoops.. The company you paid that put in the fortinet needs to do their job!!