Routing and priorities



  • Hello,

    I need a setup for this scenario:

    I have two uplinks:
    My main uplink is 195.XXX.XXX.XXX
    My secondary is 83.XXX.XXX.XXX

    PF Sense should act as a transparent firewall for these two uplinks.

    On the LAN Port should be a managed switch where all the servers are connected. Some of the servers have IP's from "main uplink" and some from "secondary".

    Is this possible ?

    And the second:

    Can I define that all requests from my LAN to WAN to a special IP 207.44.xx.xx are routed through the "secondary" Uplink?

    Thnaks and best regards

    Niels



  • The loadbalancer won't work with tranparent=bridged scenarios. It uses a gatewaypool to share the traffic between different links which needs routing.

    However, if you set it up with routing the answer to your second question is yes. Just create a rule in front of your loadbalancing rule and use the secondary link as gateway for this.



  • Hi,

    but with this two uplinks is not for load balancing. That is just for bigger bandwith.

    Best regards

    Niels



  • I think I now get what you are trying to do. It should work with 4 interfaces:

    LAN bridged to WAN
    LAN2 bridged to WAN2

    Check "enable filtering bridge" at system>advanced.

    It should even work if LAN and LAN2 are vlans I think (as you have a managed switch).

    Another option would be to use this in a routing scenario with 1:1 NATs and just 3 interfaces. Your servers have to move to a private IP-Range then in the LAN-subnet. Though it might be a bit more work at the beginning I think this setup gives you more flexibility (move one server from WAN1 to WAN2, incoming loadbalancing for your servers, …).



  • and one last question:

    Will send PFSense Traffic that goes from main <-> secondary directly to the other network or will it route the traffic to the hole internet ?

    Best regards

    Niels



  • Firewallrules will only let the traffic through you specify, so no, unless you set it up wrong it won't route the whole internet ;-)


Log in to reply