Issues with VPN routing and Failover Gateways
-
My company operates hundreds of PFsense+ routers in the field of various sizes, and have been doing so for well over a decade (this may be important). I joined back in '21 and learned from older folks during that time till now.
When setting up routers with a secondary ISP and WAN failover, general practice has been to put the failover gateway group as the default gateway on the final catch-all LAN-Allow all rule so the bulk of LAN traffic is forced to fail over. I was told that this was because sometimes traffic would ignore the default gateway change when WAN died and cause outages. Plus, doing this didn't hurt anything and was a good fail safe. Everything functioned as normal.
Fast forward to 2026 and I'm replacing routers running 2.4.5 through 23.05 with 26.03, and suddenly our site-to-site VPNs are acting up. Our main sites, with the two ISPs, could not properly route to their client sites until I removed that failover gateway from the firewall rules. From a networking pov, this makes perfect sense: you can't properly route over the VPN if the firewall is forcing you over the ISP gateway instead of the VPN gateway. These had worked perfectly fine in the older versions, and I only did a backup-restore for their replacements.
Is this just a case of an old glitch (which we had assumed was a feature) that got fixed or is this a new bug?
-
That sounds more like policy routing becoming stricter/less accidental than a VPN bug. If the LAN any rule has a gateway group set, it will also catch traffic whose destination should be reachable over IPsec/OpenVPN unless you put explicit pass rules for the remote subnets above it with gateway = default/none. I’d check the rule order and states during a test: remote-site traffic should not show a WAN gateway on the state. The old installs may simply have had states or behavior that masked the bad catch-all rule.
-
Yes that is the expected behaviour if you policy route traffic. You would normally need a rule passing traffic to the VPN subnet before that without a gateway set to avoid it.
The only other thing that might have come into play is the 'negate' rule. That is intended to allow that traffic for VPN subnets specifically and should be enabled by default.
https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#disable-negate-rules
