WAN/LAN assignment
-
Had an SG2220 that died so got a 4100 to replace it. Netgate took my backup file and updated it to read into the 4100. Great. ...but now I want to do a couple things to take advantage of the new hardware. My WAN-1 (ix3) is connected to a T-Mobile cell modem. I also have a slow, but reliable U-verse modem. I would like to plug that U-verse modem into WAN-2 (ix2). I'd like all the traffic to flow thru WAN-1, unless it goes down, then flip over to WAN-2. On the LAN assignments, I'd like the four slots to act like a 4-port switch.
Is this possible? If so, is there a "cookbook" type document that could walk me thru how to do these two things?
Thanks, Larry
-
Yes, it is possible.
Multiwan is covered quite extensively in the docs:
https://docs.netgate.com/pfsense/en/latest/multiwan/strategies.htmlUsing the 4 igc NICs as one interface requires using a bridge:
https://docs.netgate.com/pfsense/en/latest/bridges/index.html
It's worth pointing out though that using a switch for that purpose is almost always better.Steve
-
@stephenw10 - Perfect, thank you.
-
If you've not done either of things before you may well hit questions. Please ask if you do.
-
@stephenw10 said in WAN/LAN assignment:
always better.
There you go - fixed that for you ;)
Almost wasn't needed in that statement hehehe
-
@johnpoz @stephenw10 I didn't catch the implication until John emphasized it - why is using a 4 port switch better than bridging the 4 LAN outputs?
-
Because whilst a bridge acts like a switch in most ways it isn't.
The biggest difference is that the firewall still has to forward traffic when clients on the different interfaces are communicating across the bridge. That means CPU cycles are not available for WAN/LAN traffic or packages etc.
The only really good reason to run a bridge is if you to filter between hosts in the same subnet.
If you happen to have a firewall where the CPU is underused and has spare interfaces then adding them to bridge is potentially more useful than leaving them unassigned. And should not hurt unless the CPU becomes a limitation.
Steve
-
@larrym04 because bridging is not switching. There a few recent threads that have gone over some of the things you could run into trying to bridge
Lets forget the added complexity in your setup, performance wise its just not the same.
Generally speaking.. I would never bridge unless I had no other choice and had to get something working now. They are normally used to extend an L2 into say your router because of physical restrictions. Or as media conversion say a fiber into ethernet and you don't have a switch that has a fiber interface but your router does.
Just because you have some spare interfaces on your router doesn't mean they are a switch, they can never be the same from performance standpoint, or even operationally - while they can act somewhat like a switch - its not really a switch.. All traffic that comes into one side of a bridge will go out all other interfaces of the bridge.
Not like a switch where traffic for mac X would only go out the port on the switch where mac X actually is.
You would really be much better off getting an actual switch.. While a bridge can be a stop gap in like I said hey I need to get this thing up and running now. And my switch won't be here for 3 days.. Or could be a stop gap if you needed to say bring up a wireless interface on a L2 until you got a proper AP ;)
If you want a router with switch built in, then that is what you should get - netgate has a few options with switches vs discrete interfaces.
That is my personal and professional opinion on the matter - but you do you.. If you want to bridge some interfaces you go for it, but there will be a learning curve, and it most likely in the long run is not going to be as easy and straightforward as you think it is.
-
@johnpoz @stephenw10 I have a glimmer of what you're saying. I just upgraded from a 2220 with just one output. I ran that to a 4 port switch. I thought that if the 4100 had 4 outputs I could eliminate that 4 port switch. I'll stick with just setting up the WAN-2 input to a failover.
Thank you both
-
Well you can try both and see.
Despite the general opinion of bridging there are many people using them without issue.
But I would certainly recommend doing one thing at a time. Get multiwan working first.
Also if you do try bridging all the igc ports make sure you have some other access to the firewall. It's very easy to lock yourself out when adding them.
Steve
-
@stephenw10 Ummm, if there's even a remote chance of locking myself out then I'll just use the switch. I had no complaint about it... just thought I could eliminate a no longer necessary piece.
-
It's easy to lock yourself out during the creation of the bridge because you would usually reassign LAN and bridge. So if you are connected via the LAN you must take care.
As long as you have access via some other means, such as the console, you can just roll-back.
Steve
