Routing with multiple gateways on a single WAN intarface
-
Hi,
I'm installing a PF firewall and trying to setup a multi WAN setup.
The PF box has it's LAN on 192.168.1.252, with a WAN of 192.168.50.101. This has a DG of 192.168.50.2, i've then added an extra gateway of 192.168.50.1.
I'd like to set it up too send traffic from 192.168.1.245 (Another router for public WiFi) out through the 192.168.50.1 gateway, then everything else out of the 192.168.50.2 gateway.
I've setup a Firewall Rule in the LAN group to send all traffic with a source address of 192.168.1.245 through the 192.168.50.1 gateway. I can see traffic going though the rule. However if i do a tracert from the 192.168.1.245 router I am still sent out through the 192.168.50.2 gateway.
Any Suggestions?
-
And what protocol is your traceroute using icmp? Does your rule only send TCP, or does rule send everything? Linux traceroute defaults to using UDP for example.
-
Hi,
I told the rule to apply to all protocols. If i go to whatismyip.com I get the WAN ip of the 192.168.50.2 gateway, rather thn the one of the 192..168.50.1.
-
Lets see your rule (screenshot please).. Not currently setup to be able to test this… But happy to try and duplicate once my pfsense is back on line.. Hardware should be in here in a week or so.. (I hope).
What OS are you using to run the traceroute? Widnows linux?
-
See attached
I was using tracert in Windows.
Thanks
 -
So the client your forcing out the gateway is the client your doing the traceroute from is 192.168.1.245.. It didn't happen to get a different IP did it? ;)
You have no rules in floating? Its not doing the traceroute via ipv6 is it? ;)
What does your outbound nat look like, you are allowing this client to be natted out your 2nd gateway? You would need to go into hybrid or manual to allow that, etc.
-
Yep, the client IP is another router with it's WAN sat on the 192.168.1.0 subnet. It's definatly got the correct IP.
There's nothing in floating, and not tracert'ing oper IPV6 as I only get response from IPV4
Outbound NAS is at default currently (See Attached). What do I need to change to allow traffic out?
Thanks
-
Any Ideas?
-
your outbound nats do not show this other gateway as a way to nat..
You need to enable an hybrid nat to allow your lan to nat via this other gateway when you send it that way.
-
OK, so I've enabled hybrid outbound NAT & gone to add the extra rule to send traffic from 192.168.1.245 out through the 192.168.50.1 gateway. But I can't see where to specify the gateway.
Only where to specify the interface on the PF box itself. Bear in mind, I only have one WAN interface configured, then 2 gateways accessible behind that gateway.Attached screenshot with my new rule.
-
Any Idea's John?
-
My bad… I just read this over again.. I was thinking you actually had another interface for your gateway... Doh... If that was the case then you would need the outbound nat thing picking that interface.
But you only have the 1 interface and just sending to specific gateway..
So your not using any sort of proxy.. And when you got to whatsmy ip you see the correct IP for using gateway 2, but when you do traceroute your getting gateway 1.. I will really have to lab this because should work. as you have it setup.
-
Yep. That's it. No proxy or anything. Just trying to send to another gateway.
-
If I get a chance this afternoon I will fire up a VM to lab this out.. I had done this before another thread but it was 2 different interfaces
-
That would be great. Might see if I can spin up a test setup & see what happens.