Giving secondary gateway access
version of pfsense: latest
WAN: 2 IPs from separate subnets. One is assigned to the WAN interface, the other is a VIP.
LAN 1: using vlan 1, using WAN interface for OUT
LAN 2: using vlan 50, using VIP for OUT
OUT NAT: Hybrid
I have a workstation connected through a switch to vlan 50 on LAN 2 and it's getting a .50.0 address plus the gateway and dns information. My trouble is that my gateway on vlan50 isn't getting internet access and I can't add a second gateway because the GWY for my VIP isn't part of the same subnet and pfsense is giving me an error if I try and add it. How do I complete this set up?
Hybrid outbound NAT. Tell the system to use the desired VIP as the NAT address for the vlan50 source network.
Not possible to provide a more specific answer due to the lack of specifics in the question.
![Screen Shot 2018-01-09 at 10.07.44 PM.png](/public/imported_attachments/1/Screen Shot 2018-01-09 at 10.07.44 PM.png)
![Screen Shot 2018-01-09 at 10.07.44 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2018-01-09 at 10.07.44 PM.png_thumb)
I have that. My DHCP leases on vlan50 get all the right information but under system > routing > gateways I can't add my VIP gtwy of 188.8.131.52. My WAN gtwy is 184.108.40.206.
If I try and add the other gtwy into the interface I get: The gateway address 220.127.116.11 does not lie within one of the chosen interface's subnets.
luke1018 last edited by
Hi, I am trying to setup another VLAN to monitor traffic from another subnet, but unfortunately, I can only view the OUT portion only.
Have anyone faced this issue before?
![Suricata_Firewall 2.PNG](/public/imported_attachments/1/Suricata_Firewall 2.PNG)
![Suricata_Firewall 2.PNG_thumb](/public/imported_attachments/1/Suricata_Firewall 2.PNG_thumb)
Oh so you have some convoluted ISP scheme with two layer 3 networks on the same interface?
What are both sets of IP addresses, netmasks, and gateways you were given?
IP 1 18.104.22.168 /29 on WAN interface
IP 2 22.214.171.124 /32 as an "other" VIP
As far as I know you cannot do that. There is no way to reach 126.96.36.199 from either 188.8.131.52/29 or 184.108.40.206/32.
Are you SURE that is what they gave you to use?
If you need more addresses they should just route them to 220.127.116.11.
Can I use my 3rd NIC port as an additional WAN port? Or do all VIP gtwys need to be the same?
We needed another static but there wasn't enough in our range so they slapped this one onto our handoff
That seems like a silly way to do it.
Yes you can use a separate interface but it won't do you any good with a /32. Did they really give you another /30?
If the latter you could do this:
WAN 18.104.22.168/29 <–-> 22.214.171.124 Gateway
WAN2 2 126.96.36.199/30 <---> 188.8.131.52 Gateway
You would set them up like any other multi-wan. You would need an outside switch.
Seems pretty stupid to do that since it only results in one additional address for you at the cost of four addresses plus a router interface on your side. If they just routed 184.108.40.206/30 to 220.127.116.11 you could use all four addresses as VIPs and not have to mess around with multi-wan.