Windows Network Load Balancing and pfSense

  • Hey

    I want to host a number of Windows servers that are configured as NLB. My switches support IGMP snooping, but I've read several places that it is necessary that the router supports special ARP messages.

    Does pfSense supports these types of messages?

    Are there other things I should consider before I use NLB cluster in multicast mode?

    On this website (, describes the following:

    Note When the local router must send a packet to the virtual IP address, the local router uses address resolution protocol (ARP) to determine the virtual IP's MAC address. WLBS replies to these ARP requests. When you mask the source MAC address, the ARP response from WLBS has a substitute source MAC address in the Ethernet frame, but contains the correct cluster MAC address in the ARP header. Some routers cannot make this ARP mapping and must make a static ARP entry in the router. For additional information about static ARP requirements, click the following article number to view the article in the Microsoft Knowledge Base: 197862  ( ) WLBS cluster is unreachable from outside networks

    The cluster uses a multicast MAC address that is mapped to a unicast IP address. The switch does not associate the multicast MAC addresses to a port, so the switch sends frames to this MAC address on all the ports. IP Multicast pruning implementations cannot limit the port flooding, therefore you must use a virtual LAN. Multicast provides no advantage over unicast from the switches perspective. The increased multicast processing overhead for routers and switches may lead to slower performance. Carefully analyze the effect on your network when you uses multicast to avoid congesting other network devices.

    I hope someone can help me

  • Is it maybe possible to add ARP mappings manually in pfSense?

  • No issue with the firewall there, the ARP NLB uses should work fine (I know of many who are using it).

  • Thanks

    Are you sure they are running NLB in multicast mode? All routere should work with the unicast mode, but it floods our DMZ.

  • cmb: Should I setup something on the PfSense or should it support NLB running in multicast-mode out of the box?

Log in to reply