2 WAN Failover but with two pfSense gateways?!?!

  • Today I setup HSRP using Cisco gear in a lab and accomplished exactly what I would like to accomplish at work; but I need to do this with two pfSense boxen since we don't have any Cisco gear at work.  Here is the scenario with the Cisco stuff: Two routers each with one WAN link. Router A has IP with a 10mbit fiber link and Router B has IP with a 5mbit Cable link.  Both routers connect to one LAN and all hosts on the LAN are configured to use the Virtual IP as their gateway (  Using HSRP I configured each router to monitor the other and then created a Virutal IP of  I then designated one router as Active and the other as Standby.  What will cause a failover even in this case is not only a downed router but a downed WAN link.  Each router was configured to monitor the state of the WAN interface.  I had a host conduct a continuous ping to a loopback interface located outside the network and I took turns physically disconnecting each WAN link (but always keeping one link up to test the failover). It worked very well and I only dropped a few packets.

    So how can I accomplish this with two pfsense machines?  Here is how my work network is setup:  We have a colo with a fiber WAN link (static IP) that connects to a pfSense box.  The LAN interface of the pfSense box connects to a small switch in our colo rack that is on our LAN.  Our actual facility is 45 miles away and connected via a p-to-p fiber link to our core switch that is also part of our LAN. Inside our facility we have a Cable Modem WAN link that I would like to use as the backup in the event that either the WAN link at the colocation goes down or our p-to-p fiber link goes down (effectively the same thing).  Since I can't get the WAN links within close physical proximity I am stuck using two gateway machines (maybe I could get tricky with some VLANing but that might just add another point of failure).  I understand that CARP is for hardware failover and that LB is for link failover but how can I do this with my situation?

    I am not too worried about the DNS side of things since I can intervene and manually change the DNS entires in the event of a WAN failure.

    btw, what are you experts out there using for network diagrams I see around here? This scenario would be easier to explain with some graphics.

  • have you considered putting both WAN interfaces on each pfsense box and use carp to failover?

    alternatively, you could have pfsense box 2 be tier2 of a failover on pfsense box 1, and vice versa.  You could load balance and failover also.

Log in to reply