Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    I don't want to load balance or fall over, I need 2 WANs independent

    Routing and Multi WAN
    3
    12
    1.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      NewGuy
      last edited by

      On the first WAN is my DSL connection-it is the one with the lowest latency but the least overall bandwidth it is on a router that has VPN, I want to keep it that way. The 2nd WAN is satellite internet and the latency is terrible(not good for online gaming) but it downloads stuff much faster than the DSL could hope to. I get tops 350Kbps with DSL and 3.2MBps with satillite. I was wanting to bond certain ports to each WAN like have my satellite service handle my FTP (port 21)downloads while my DSL handles all browsing HTTP and HTTPS(I forgot the ports).
      I have a pfSense box that I made last year that has 3 NICs but cannot fit anymore. Right now I have the WANs on 2 separate routers which when I had a CAT6 going from 1 to the other on the LAN ports they were almost able to do what I need. I say almost because the 2nd router(satellite) would send the browsing request to my 1st router and put it in front of the VPN(encryption was bypassed).

      I want the DSL router to be in front of pfSense if it(pfSense) can handle the satellite internet on it's own, I could then use the 2nd router after pfSense for distribution to my home.  It has really good wireless coverage and it would be a shame to waste it on just being a dedicated WAN uplink with no wired or wireless clients.
      Can pfSense do what I need it to do?
      If so how would I go about it? I think that pfSense can do what I need it to do, I set up a VPN service on it a year ago and still remember a little about it.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Just policy route the traffic you want to a specific WAN gateway instead of a failover/load balance gateway group.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • N
          NewGuy
          last edited by

          Thank you for your reply. How would I go about it? The most I've done in pfSense was to follow a tutorial for setting up a VPN service.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Countless examples here for policy routing. Please search first.

            https://doc.pfsense.org/index.php/What_is_policy_routing

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • C
              CC
              last edited by

              If you 3 NIC's on your Pfsense box then why do you need more?

              1. DSL
              2. SAT
              3. LAN

              Set up DSL and SAT in interfaces then inside your firewall rulebase create rules for things like FTP and in one of the advanced dropdown boxes you can select the WAN interface the traffic needs to be routed out of.

              As Derelict said, it's literally routing selection within the policy. (same principle but different nomenclature to things like cisco PBR)

              1 Reply Last reply Reply Quote 0
              • N
                NewGuy
                last edited by

                On watching several videos and reading some more about it I have decided to let pfSense handle both WANs, I was looking for the easy way out keeping a router as my DSL hookup because it is very easy to setup the OpenVPN that way(I feel ashamed). I will take the time to learn and to use pfSense to handle both my VPN and my unencrypted satellite connects then pass them into a wireless router configured as an access point to distribute to my house all the APs  in it. One thing I really want to learn about is how to setup a VPN kill switch in pfSense and have it NOT re-route my traffic to satellite if the VPN goes down. Instead have it wait until the VPN is restored.
                I have books ordered and have been watching videos but the most nfo I got was searching this forum but I am still unsure how to go about it exactly. I have been reading in particular this post by Derelict:
                https://forum.pfsense.org/index.php?topic=84463.msg463226#msg463226
                what I am unsure of is how to keep the requests from seeing that the VPN is blocked then just using my other unencrypted WAN instead.
                Thanks

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Search NO_WAN_EGRESS in the search box above.

                  Actually, that appears to only search recent posts. Use search in the menu bar.

                  You basically tag traffic that should go out the VPN as such and block it if it is going out a WAN interface in-the-clear. Best way, IMHO.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • N
                    NewGuy
                    last edited by

                    Thanks Derelict, please continue to help me I am learning.
                    I need to know how to setup DNS for one WAN(DSL VPN) but not have it effect the other (satellite non VPN, get the provider's DNS automatically). The videos I have been watching either assume that I have one WAN or am trying to load balance. I have searched this forum but do not seem able to find this information.

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      No idea what you're talking about.

                      DNS queries are done by a client, not a firewall. You will have to be more clear about what you are looking to accomplish.

                      Are you trying to circumvent snooper's charter?

                      Trying to avoid DNS geolocation for video streaming?

                      ??

                      It's a lot easier to give you advice if you are not being cagey about what it is you are trying to do.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • N
                        NewGuy
                        last edited by

                        Yes I stream. But I also don't want geolocation at all because the DSL is my family's connection.
                        in the videos to set up my VPN it says to enter the DNS on SystemGeneral Setup page but if I do that from there won't that be setting it for both WANs?

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Still not close to enough information.

                          DNS is generally done by the clients. If a client is configured to use internet DNS servers and all internet traffic is forced out the VPN then all queries will appear to be sourced from the VPN.

                          There are about 1000 different ways to configure a network. You are going to have to be more specific about what you want to do.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • N
                            NewGuy
                            last edited by

                            I think that you misunderstood. I am not trying to force ALL traffic to use the VPN just browsing and basic services I want routed to the VPN both http and https especially, and my daughters' games and Netflix.
                            Every thing else must go out on the unencrypted satellite connection.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post