Static route using a Gateway Group
-
Is there a reason that I can not set a static route using a Gateway Group? Also I can not set a second static route to the same destination via another gateway. I could do policy routing, but what to do if the firewall itself should use it too.
-
I think that is because the two features sit at different layers. A static route has to install a concrete next-hop in the routing table, while a gateway group is mainly a firewall-rule/policy-routing object. So for traffic generated by pfSense itself there is no rule match where the group can be selected. If the firewall needs failover for that destination, I would look at dynamic routing/FRR or an external/scripted route change tied to gateway status, not duplicate static routes to the same prefix.
-
For the default gateway this already exist, so it could be done but hasn't.
-
@Bob.Dig I just went down a small rabbit hole before digging myself out before it was too late and the whole day was lost.
Turns out the redmine that I was going to look for was opened by ME (haha) 10 f**king years ago. Now I don't feel so bad that I forgot about it.
-
Mmm, you can't policy route on an outbound floating rule like that. The routing decision is set before it hits the rule. For the same reason you can't set a load-balance group as the default gateway.
Potentially it should be possible to set a gateway group on a static route but to do so would require a bunch of new code to build the new routes if any gateway state changed.
