Dual WAN Setup on XG-7100

  • Hi naalpv

    The link did not work. I wonder how you actually did it. Can you fix the link so we can see what configurations you made

  • First Wan connection configurations (default 4090)

    Second WAN connection

  • Netgate Administrator

    What it that floating rule applied to?

  • floating rules applies to Lan + other vlans created. Beside the floating rules I also set each vlans to use groupgateway instead of the default.

    see below for one of the vlans I created

  • Netgate Administrator

    Hmm, that floating rule cannot be applied correctly. There are no states and no traffic recorded against it. Instead evetything is hitting the rule on the interface.
    However that should work for load-balancing as long as clients are using some DNS server other than Unbound in pfSense.

    Does it load-balance correct when both WANs are up?


  • @stephenw10 Are you suggesting to force vlans to use Unbound (pfsense) as the primary DNS and block outside DNS request ?

  • Netgate Administrator

    No. I'm saying that if you were doing that then Unbound itself always uses the system default route which will not failover.
    But since you're not doing that it shouldn't be a problem.

    I think you need to confirm both WANs are in fact working. Make sure you can ping out of both from Diag > Ping.

    Set a policy route for just WAN2 for one test client IP in LAN and make sure that can still get out and is in fact using WAN2.


  • @ragnarXYZ

    did you manage to setup dual WAN on XG-7100 ? I have not been able to do dual wan setup and I'm about to throw away my new xg-7100 box and switch back to dell server which have 5 physical interfaces since it is my easier to do on it than XG-7100.

    If you did can you kindly share your knowledge on this ?

    I try this link and it brings me to another side ...


  • Netgate Administrator

    Ragnar has not logged in since Aug 2018 so I think you may be waiting a while! 😉

    What part are you stuck on? What's not working?

    Did you get the gateway monitoring tuned so both gateways show as on-line?

    The XG-7100 part of the config you already had correct. It was the gateway failover part that was working. It would be no better on other harwdare.


  • Hey! Sorry for not logging in for so long... :) @wintok and @stephenw10

    So, yes I did get this running. I had 1gb up/down fiber and 1 gb/40mb up/down cable with failover running.

    I've since (sadly) got rid of the cable line so I no longer have 2 WAN connections, however I'm pretty sure that I did not change the config. If you need updates @wintok I'll get some updated screenshots and post them. LMK

  • @stephenw10
    I have not given up completely on XG-7100. I did manage to setup dual wan config successfully during the week-end.

    Happy to share with you guys if you need it.

  • Netgate Administrator

    Good to hear. 👍

  • @wintok Can you share with me the configuration of the dual wan on the xg-7100?
    I am getting mad with the marvel chip.

    Best Rehards Tim

  • Netgate Administrator

    What problem are you seeing?

    Trying to setup a seconds WAN port on the switch?


  • Yes need to setup 3 additional WAN Ports (totally 4 WAN and 2 LAN Ports) for a fallback and smart rooting.

  • @stephenw10 Forgot to reply direct to you.
    Yes I want to setup additional WAN ports on the switch.

  • Netgate Administrator

    Ok, so, in summary, you need to:

    Add a new VLAN on lagg0 from Interfaces > Assign to use as WAN2 for example 4092

    Configure the switch to use that new VLAN. You can use the default WAN (4090) as an example here.
    On the Switch > Ports tab chage the PVID of the port you want to use to the new ID, for example 4092.
    On the Switch > VLAN tab add a new VLAN group with the new ID (4092).
    Add to it the port you want to use as untagged and 9 & 10 as tagged.

    Remove the port you;re using from the LAN vlan group (4091).

    We did a hangout on this with a lot more detail:
    Youtube Video


  • @Timbobx
    Hi Timbox

    I use ports ETH1 (primary) and ETH2 (secondary) for WAN connections. First you need to change Port VID of the Port (in my case ETH2) for your secondary WAN connection. The default Port VID is 4091 and I changed to 4092. It's editable , double click , change , click and hit save. [Interfaces->Switch->System->Ports]
    Assign port eth2 to 4092.PNG

    For the next part you need to add your VLANs and add members [Interfaces->Switch->System->VLANs]
    Secondary Internet Connection.PNG

    Add port 2 (untagged) and port 9 and 10 both as tagged members above. Incase If you need to compare the configuration for the primary WAN see below. It has members port 1 (untagged) and 9 and 10 both as tagged memebers.

    primary Internet Connection.PNG

    When you finish the above configuration next you need to your configure VLANs again but this time you add your vlan 4092 and choose your parent interface.
    For Parent interface choose lagg0 for VLAN Tag enter 4092 and VLAN Priority leave as 0 and for description give wan2 for instance (in my case ATHKL) and Hit save


    At this stage the new interface is now ready to be configured
    Interfaces->Assingments->Interface Assingments
    Click on new interface see below and configure its ip settings.


    Your second WAN should be up and running if follow the instructions correctly. You might also might need to configure WAN fail over to utilize the two connections ....

  • @stephenw10 said in Dual WAN Setup on XG-7100:


    Thanks! For the work/ documentation.

    My open questions is, where can I change the MAC-Adresses of the interfaces. I need different MAC-Addresses on each interface. I have an ISP with lines of 1000 MBit. But the ISP is sending me 3 times the same IP because on 3 ports I have the same MAC-Adddress. And I cannot find a place where I can change it on the parent interface.

    Example WAN2 VLAN 4083 on ETH3

    has lagg0 as parent device.
    Like WAN3 VLAN 4084 on ETH4 and
    like WAN4 VLAN 4085 on ETH5


    What did I wrong?

    Best Regards Tim

  • Netgate Administrator

    That's a problem.
    The VLAN interface inherits it's MAC address from the parent interface and all those VLANs are on the same parent, lagg0.
    It's possible to separate the lagg interface and usr the two ix NICs are parent to give two MAC addresses.

    It's a horrible hack but you may be able to create a single interface bridge where you can spoof the MAC to give 3 total.

    Really though you should have the expansion card to use 4 discrete NICs for that.


Log in to reply