<![CDATA[Possible to select gateway based on URL ?]]>I have two internet connections at my home, one being provided by my employer (on campus internet @ 1 Gbps), and a secondary connection for which I pay (200 Mbps).

The campus internet blocks access to some of the websites, and even some file downloads (like ISOs) are blocked. YouTube and other sites work absolutely fine.

I was wondering if there's a way to direct traffic through a specific gateway based on the URL ?

]]>https://forum.netgate.com/topic/156788/possible-to-select-gateway-based-on-urlRSS for NodeSun, 12 Apr 2026 10:05:20 GMTSat, 12 Sep 2020 09:21:20 GMT60<![CDATA[Reply to Possible to select gateway based on URL ? on Mon, 14 Sep 2020 15:15:42 GMT]]>Updated setup :

Router 1 (College Campus) : 10.1.0.1/16
Router 2 (ISP Router) : 10.1.0.4/16
Both Routers connected to each other. Hence R1, R2, pfSense WAN on same layer 2 network.

pfSense :
WAN 1 : 10.1.0.2/30 Gateway : 10.1.0.1 (Default Route)
WAN 2 : 10.1.0.5/30 Gateway : 10.1.0.4
LAN 1 : 192.168.1.1/24

Firewall Rules for LAN :
Alias containing FQDN of all websites :
6b96fa66-776e-4ff8-bbe7-aedc38148776-image.png
LAN Firewall Rules :
3afd9723-cda6-4f17-aa55-6f24bb65fd59-image.png

Traceroute Diagnostics :
8e909d0a-e047-4a0a-b12c-790c0c05c888-image.png

Results :
e5319961-1ec7-4e52-aa9a-b74a76de46e9-image.png

Test (if BlockedWebsites firewall rule is disabled)
b0c5d34f-029d-4947-a6a8-1741f6e7d4af-image.png

So yes, I believe that Sophos ( the firewall which my campus uses) blocks access to the TLD name, hence blocking any chance of redirect. So I guess I was partly right in saying that Sophos can't really block CDNs since many websites originate from the very same CDN.

Also, I still can't understand properly what causes so much trouble if both the gateways are on the same subnet.

]]>https://forum.netgate.com/post/934601https://forum.netgate.com/post/934601Mon, 14 Sep 2020 15:15:42 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Mon, 14 Sep 2020 14:40:12 GMT]]>Well yeah you kind of need a working 2nd gateway to be able to policy route through it ;)

]]>https://forum.netgate.com/post/934594https://forum.netgate.com/post/934594Mon, 14 Sep 2020 14:40:12 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Mon, 14 Sep 2020 14:35:44 GMT]]>@johnpoz said in Possible to select gateway based on URL ?:

Why did you start another thread?

Because I though topics are different, the other thread is just asking for URL based routing (not necessarily about gateways on same subnet).

@johnpoz said in Possible to select gateway based on URL ?:

Where client only uses 1 gateway..
There is a VM hooked behind pfSense, through which I am doing all the tests. Hence all traffic is infact flowing through pfSense (the only gateway on the VM).

I guess the whole issue is because both my gateways are on the same subnet. I'll try moving them to separate subnets, see if things work.

]]>https://forum.netgate.com/post/934592https://forum.netgate.com/post/934592Mon, 14 Sep 2020 14:35:44 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Mon, 14 Sep 2020 13:44:13 GMT]]>Why did you start another thread?

And your whole setup is BORKED, from reading that other thread.. If you want to policy route than you need to have both wan connections routed through pfsense.. Where client only uses 1 gateway..

]]>https://forum.netgate.com/post/934580https://forum.netgate.com/post/934580Mon, 14 Sep 2020 13:44:13 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sun, 13 Sep 2020 12:59:12 GMT]]>@johnpoz said in Possible to select gateway based on URL ?:

again.. msn.com doesn't do anything but redirect you to a different IP.. So that is not going to work..

I believe that my campus internet is blocking access to msn.com also, since I can successfully ping www.msn.com but not msn.com. Also, since a lot of content is hosted through (microsoft) CDN (bing works), I believe that the block is at the first level only, preventing msn.com from loading up, hence no redirects, and the page fails to loads up.

@johnpoz said in Possible to select gateway based on URL ?:

because your policy route is for tcp only.

Tried with all protocols, still no success.

@johnpoz said in Possible to select gateway based on URL ?:

Did you validate your table shows the IPs?

I'll post updates once I'm back home.

@johnpoz said in Possible to select gateway based on URL ?:

Have you validated your gateway even works - route all your traffic through it

Yes. My secondary gateway works (no blocks) if I set it up as the sole gateway on pfSense.

However, if I setup my secondary gateway by going under System > Routing, and then create a firewall rule for this second gateway, even then this rule doesn't apply and all my traffic gets routed through the first gateway regardless of any firewall rules.

a60e2038-1f5e-47f6-bec5-8d92162d05f7-image.png

@dr_tech said in Possible to select gateway based on URL ?:

Gateways :
69b9e8c6-bf53-418a-bcac-6112e322dd5f-image.png

]]>https://forum.netgate.com/post/934391https://forum.netgate.com/post/934391Sun, 13 Sep 2020 12:59:12 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sun, 13 Sep 2020 12:18:00 GMT]]>@dr_tech said in Possible to select gateway based on URL ?:

I tried pinging msn.com

again.. msn.com doesn't do anything but redirect you to a different IP.. So that is not going to work..

curl msn.com
<head><title>Document Moved</title></head>
<body><h1>Object Moved</h1>This document may be found <a HREF="http://www.msn.com/">here</a></body>

Which is a different IP.

$ dig msn.com +short
13.82.28.61

$ dig www.msn.com +short
www-msn-com.a-0003.a-msedge.net.
a-0003.a-msedge.net.
204.79.197.203

And your ping wouldn't ever go through that policy route, because your policy route is for tcp only.

Did you validate your table shows the IPs?

example
tables.png

Have you validated your gateway even works - route all your traffic through it.. Do a traceroute showing your path that will be taken.. Via the IP your trying to hit, etc.

]]>https://forum.netgate.com/post/934368https://forum.netgate.com/post/934368Sun, 13 Sep 2020 12:18:00 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sun, 13 Sep 2020 12:07:15 GMT]]>@johnpoz said in Possible to select gateway based on URL ?:

IPv6

No, I don't have IPv6 on any of my gateways.

Also, as far as DOH is concerned, I tried pinging msn.com, x1337x.ws, and other similar blocked sites directly through Windows Ping utility, and the resolved IP is the same as what pfSense DNS lookup shows.

]]>https://forum.netgate.com/post/934366https://forum.netgate.com/post/934366Sun, 13 Sep 2020 12:07:15 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sun, 13 Sep 2020 11:33:16 GMT]]>@dr_tech said in Possible to select gateway based on URL ?:

(hoping that the resolved DNS IP gets refreshed once every while)

They do, by default every 5 minutes.

I would suggest you actually validate the table you created contains the IPs you expect to be using, and what your client is using to get there.

Also with browsers using their own dns via doh, you can run into a whole different problem were they resolve something different than pfsense did.

For such aliases to work for firewall rules, you need to make sure your client is actually resolving via pfsense, so you more likely to have the client trying to go to the IP that pfsense has for the www.domain.tld it resolved, etc.

Another issue - are you even using IPv4 to get there, many sites these days have IPv6, your x1337x.ws example

104.31.68.27	A
172.67.218.132	A
104.31.69.27	A
2606:4700:3034::681f:441b	AAAA
2606:4700:3030::ac43:da84	AAAA
2606:4700:3030::681f:451b	AAAA

So did you client try and use IPv6 to get there, if so then it wouldn't be forced out your gateway because its only a IPv4 rule, etc.

]]>https://forum.netgate.com/post/934358https://forum.netgate.com/post/934358Sun, 13 Sep 2020 11:33:16 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sun, 13 Sep 2020 11:22:33 GMT]]>@johnpoz said in Possible to select gateway based on URL ?:

Hosted off CDN.. that IPs will change all the time, etc. And the IPs are different..

Yes, that is why I thought of using DNS names instead of explicit IP addresses in the first place (hoping that the resolved DNS IP gets refreshed once every while), providing a better firewall rule than just using a static IP.

@johnpoz said in Possible to select gateway based on URL ?:

For starters which is is x133x or x1337x ??

I'm sorry, it's x1337x.ws. It was a typo that I corrected soon afterwards. Still it doesn't work.

]]>https://forum.netgate.com/post/934357https://forum.netgate.com/post/934357Sun, 13 Sep 2020 11:22:33 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sun, 13 Sep 2020 10:16:15 GMT]]>For starters which is is x133x or x1337x ??

You have alias that is different then what you put in the browser

Do a simple traceroute to show you which path your taking

Your msn is going to be difficult because you put in msn.com but that redirects to www.msn.com

which is a cname anyway.

;; ANSWER SECTION:
www.msn.com.            21591   IN      CNAME   www-msn-com.a-0003.a-msedge.net.
www-msn-com.a-0003.a-msedge.net. 3591 IN CNAME  a-0003.a-msedge.net.
a-0003.a-msedge.net.    3591    IN      A       204.79.197.203

Hosted off CDN.. that IPs will change all the time, etc. And the IPs are different..

]]>https://forum.netgate.com/post/934350https://forum.netgate.com/post/934350Sun, 13 Sep 2020 10:16:15 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sun, 13 Sep 2020 09:25:53 GMT]]>Gateways :
a8d99599-eef0-4e32-a31c-3722c553ea62-image.png

Firewall Alias :
a3b00e28-8ce1-41e0-a4a4-ef7b149131fa-image.png

Firewall Rule For LAN :
8a631dd3-8a75-4c65-8e3b-c59d766a0970-image.png

Test Results :
8d89c563-860c-4c30-ac3e-e81f7464ce5b-image.png 1647893d-8d4d-4c45-b574-59020a4a4772-image.png

]]>https://forum.netgate.com/post/934344https://forum.netgate.com/post/934344Sun, 13 Sep 2020 09:25:53 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sun, 13 Sep 2020 08:47:50 GMT]]>@dr_tech said in Possible to select gateway based on URL ?:

x133x.ws,

Please show the firewall rule and gateway settings

]]>https://forum.netgate.com/post/934338https://forum.netgate.com/post/934338Sun, 13 Sep 2020 08:47:50 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sat, 12 Sep 2020 16:21:49 GMT]]>I have already tried setting up a firewall alias using the FQDN, x133x.ws, which happens to be a blocked site on the campus, to be routed through my paid internet connection.

However, there's no change when I try to access the website, even a traceroute shows that the gateway being is used is that of the campus internet connection.

]]>https://forum.netgate.com/post/934225https://forum.netgate.com/post/934225Sat, 12 Sep 2020 16:21:49 GMT<![CDATA[Reply to Possible to select gateway based on URL ? on Sat, 12 Sep 2020 12:47:18 GMT]]>it's possible to direct traffic to specific gateway based on the source/destination IP address or FQDN (limited, see https://docs.netgate.com/pfsense/en/latest/firewall/using-fqdns-in-aliases.html)

see Policy Based Routing:
https://docs.netgate.com/pfsense/en/latest/book/multiwan/policy-routing-configuration.html

]]>https://forum.netgate.com/post/934168https://forum.netgate.com/post/934168Sat, 12 Sep 2020 12:47:18 GMT