Issue regarding static routes - redirect traffic to other gateway on lan
-
Good Day.
I have a pfsense 1.2 RC 1 box running perfectly, but there is a weird issue that we encounter when we tried to set a static route for a specific block of IP's to our co-location servers.
This is our network layout
isp 1 isp 2
| |
| |
(eth0.1) (eth0.2)
multi wan router -linux box
|(lan-side 10.10.100.1/24)
|
|
|(wan-side 10.10.100.2/24)
Pfsense 1.2.RC 1 -NAT/Traffic Shapper/Squid/DHCP services turned ON
|(lan-side 192.168.1.1/24)
|
|
|
Lan switch
| | |____(192.168.1.3) Cisco router@office–--(leasedline)- ---cisco@datacenter1----servers
| |
| |________(192.168.1.2) Cisco router@office---(leasedline)- ---cisco@datacenter2----servers
|
|
|
PC's 192.168.1.0/24 -GW 192.168.1.1My Static rules in Pfsense are:
Traffic to ip's to datacenters servers1 (all devices routes are configured) will be sent to gateway 192.168.1.2
Traffic to ip's to datacenters servers2 (all devices routes are configured) will be sent to gateway 192.168.1.3
Now my problem is that whenever a sessions/connections are made (paticularly ssh) on the servers in the datacenter 1 & 2 ….
we encounter drop connections (our ssh sessions disconnects after couple of minutes connected).Note: Our observation is when a traffic destined to datacenters are redirected/resolve by pfsense issue arise but when a pc has hardcoded routes to datacenters works connections/sessions works perfectly.
Does anyone encountered issues like this in making Static routes pointing to different gateway inside the lan?Thanks
-
Yes! I have. Running 1.2.1 RC2.
When redirecting traffic to a specific source to another gateway in the LAN the pfsense starts to block the traffic after approx 30 seconds. The destination is a remote desktop running through a VPN tunnel. And, the problem only occurs when accessing from a subnet on the LAN.
The connection is seems to be alive. Though The pfsense seems to block mouseclicks and so on and the connection times out.
Everything has been working okey up to a day ago.
Did you find the solution??
-
System -> Advanced, enable bypass filtering for traffic on same interface. You have asymmetric routing, which can't properly be statefully filtered.