Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port forwarding not working correctly with multi wan

    Scheduled Pinned Locked Moved Routing and Multi WAN
    13 Posts 2 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      aduzsardi
      last edited by

      Hi,
      We have a Netgate 7100 with dual WAN configured , the second WAN is using the same ISP but with a different subnet and upstream gateway.

      We inherited this network from a small company that we merge with and for now we have to keep it with all it's port forwards to different internal servers.

      The issue we are having is that we can't get it working consistently, for example we forward a udp port for openvpn to an internal IP on that separate VLAN and sometimes it works sometimes it doesn't (when i say it doesn't the connection never reaches internal IP), same with tcp ports 80 and 443

      Here are some screen captures , maybe somebody can point out the issue , WAN2 and OLD (LAN) are the corresponding wan and internal network
      LAGG1 is using the two 10Gbps NICs and LAGG0 is using the switchports

      Any help in getting this sorted out would be much appreciated

      Interfaces

      05bb6278-38a8-48bb-b9f5-2a6bc6e6d4f3-image.png
      dd110d14-53cc-424f-92ba-dd56590fd396-image.png
      a5af5437-e0c7-4993-9f84-bcabbc264646-image.png
      bba0300f-dd1b-422e-80d9-12c5f98aed7d-image.png
      388f9607-3dfd-48a1-a542-f6f2a915d69d-image.png

      Firewall

      854eb2f5-f758-4cce-b08a-a1e7dd6e5385-image.png
      0bfa6d44-b4e6-47c7-9afa-1df15c1ba49a-image.png
      7042bb8f-8a78-428a-9621-2cb09daf7b48-image.png

      1 Reply Last reply Reply Quote 0
      • A
        aduzsardi
        last edited by

        actually it doesn't work at all

        1 Reply Last reply Reply Quote 0
        • A
          aduzsardi
          last edited by

          Could it be because i've used the second port on the integrated switch for the WAN2 interface ?
          I just noticed that the link on the Webui says /interfaces.php?if=lan , does that matter other than the UI ?

          A 1 Reply Last reply Reply Quote 0
          • A
            aduzsardi @aduzsardi
            last edited by

            @aduzsardi said in Port forwarding not working correctly with multi wan:

            Could it be because i've used the second port on the integrated switch for the WAN2 interface ?
            I just noticed that the link on the Webui says /interfaces.php?if=lan , does that matter other than the UI ?

            nope , seems like it's not that ... seems to me pfSense doesn't do well with multi-wan from the same ISP

            V 1 Reply Last reply Reply Quote 0
            • V
              viragomann @aduzsardi
              last edited by

              @aduzsardi
              Basically it should work if the WANs are in different subnets and use different gateways.

              Do you have any floating rules?

              @aduzsardi said in Port forwarding not working correctly with multi wan:

              for example we forward a udp port for openvpn to an internal IP on that separate VLAN and sometimes it works sometimes it doesn't (when i say it doesn't the connection never reaches internal IP)

              Did you verify that by sniffing the traffic?

              A 1 Reply Last reply Reply Quote 0
              • A
                aduzsardi @viragomann
                last edited by aduzsardi

                @viragomann it should but it doesn't
                same thing , sometimes it does , sometimes it doesn't and i have no idea how to debug it
                just tested with ICMP , pinged WAN2 IP from a remote site like 10 times (meaning i repeated the command 10 times) and it worked after a minute of waiting a few times , most of the times it didn't, just timed out

                LE: i don't have any floating rules

                if i ping the WAN2 IP after a period of time i'm getting replies (approximately after 15-20 seconds)

                --- 86.x.x.x ping statistics ---
                18 packets transmitted, 9 received, 50% packet loss, time 17225ms
                rtt min/avg/max/mdev = 34.308/35.349/35.745/0.485 ms

                V 1 Reply Last reply Reply Quote 0
                • V
                  viragomann @aduzsardi
                  last edited by

                  @aduzsardi said in Port forwarding not working correctly with multi wan:

                  just tested with ICMP , pinged WAN2 IP from a remote site like 10 times (meaning i repeated the command 10 times) and it worked after a minute of waiting a few times , most of the times it didn't, just timed out

                  I guess, you didn't forward ICMP, did you?
                  If not it's pfSense itself who is responding here.
                  If you get timouts some times, check if the packets really arrive at pfSense WAN2 by running a packet capture.

                  A 1 Reply Last reply Reply Quote 0
                  • A
                    aduzsardi @viragomann
                    last edited by

                    @viragomann no i haven't forwarded icmp , it's the firewall itself responding but with a huge delay (packet loss)

                    just tested the same thing on WAN1 , and i don't have this issue ... everything works as expected icmp , port forwards ... no traffic is lost

                    very weird , do i need to configure VLANs on the switch that's conected to the two WAN ports on pfSense and the ISP router ? Afaik you don't need to do that since the ISP router/hardware doesn't do VLANs anyway.
                    54a74093-529c-48f6-9fc8-767085fa0969-image.png
                    There's one thing i can try maybe tomorrow or the day after that and that is to see if WAN2 works with the patch cable that's in WAN1 now

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @aduzsardi
                      last edited by

                      @aduzsardi
                      That is not a true dual-WAN setup at all.

                      In this case, remove the switch and configure both subnets on a single WAN interface.

                      A 1 Reply Last reply Reply Quote 0
                      • A
                        aduzsardi @viragomann
                        last edited by

                        @viragomann not sure what you mean by that, i have a single uplink to the ISP so i need to split it with a switch

                        why is not really a multi-wan ?
                        I have two public ip addresses within two different subnets and two different uplink gateways.

                        How would i add both IP addresses on the same interface ? :)

                        Thank you for all your help!

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @aduzsardi
                          last edited by

                          @aduzsardi said in Port forwarding not working correctly with multi wan:

                          i have a single uplink to the ISP so i need to split it with a switch
                          why is not really a multi-wan ?

                          Since both of your subnets are on a single interface on the ISP router, they can also be on a single interface on pfSense. What do you think is the benefit of an L2 switch here?

                          How would i add both IP addresses on the same interface ? :)

                          Add the second subnet as virtual IP to the WAN. Firewall > Virtual IPs. Use type "IP alias".
                          Then if needed, add the second gateway to WAN: System > Routing > Gateways.

                          If the second subnet is routed to the primary WAN IP you can use the IPs directly in portforwarding rules. If not, you have to assign each single IP as "IP alias", but this is the same for the primary subnet.

                          If you want to use an IP of the secondary subnet for outbound traffic, you need to configure outbound rules accordingly.

                          A 1 Reply Last reply Reply Quote 0
                          • A
                            aduzsardi @viragomann
                            last edited by

                            @viragomann you were absolutely right , thank you very much
                            although it's weird that it worked intermittently before as well ¯\(ツ)/¯

                            i'm curious as to how does pfsense know to use the second isp gateway for the IP alias

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @aduzsardi
                              last edited by

                              @aduzsardi
                              Basically the default gateway is used. But if a request goes to an IP out of the second subnet pfSense uses this IP for response as well, of course. Now if the default gateway lies outside of this subnet it will use the gateway that matches the subnet.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.