Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multi Wan and DNS Forwarder/NTP fails when Wan drops

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    6 Posts 3 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kitdavis
      last edited by

      I have two wan connections that fail over within a gateway group.  I have a DNS server identified for each interface, one for Wan1 using the gateway for Wan1 and another setup for Wan2.

      When Wan1 fails, network traffic flows through Wan2 as it should.  However the DNS forwarder doesn't get any DNS entries.  If a client uses the pfsense box for DNS, then it can't querry addresses.  But, if the client uses the same DNS server as the Wan2 connection uses then it works.

      Additionally, if the Wan1 gateway is down, then if pfsense is restarted, the NTP clock routine takes 3 or 4 minutes to time out as does the DNS forwarding startup.  Finally, once pfsense is up and running, then it can't obtain update status nor package information.  I must have something configured wrong, but setting up the failover gateways seems pretty straight forward.

      1 Reply Last reply Reply Quote 0
      • K
        kitdavis
        last edited by

        I forgot to add, that I also have static routes set up to each of the DNS servers.

        1 Reply Last reply Reply Quote 0
        • H
          heper
          last edited by

          you need to add a floating rule to sort this

          pass / don't select interface / protocol tcp-udp / source=any / destination=any / destination portrange=53 (dns) / gateway=loadbalance_group

          this will sort out the dns forwarder issues and will also sort out the update status issue, most likely it will fix the ntp issues aswell

          1 Reply Last reply Reply Quote 0
          • K
            kitdavis
            last edited by

            Thanks - that fixed the DNS issue, but not the package/ntp issue.  However, I suspect that if I dig into the floating rules a bit more I can solve the rest of the issues.  I had been meaning to figure out what the purpose of those rules were, so I'm happy to get pushed in that direction.  Thanks again.

            1 Reply Last reply Reply Quote 0
            • G
              geeknik
              last edited by

              Do the same thing with port 123 for NTP. Should solve that issue. =)

              1 Reply Last reply Reply Quote 0
              • K
                kitdavis
                last edited by

                The floating rules fix the DNS and UDP problem after bootup, but do nothing for the start times (adding 5 minutes to the boot up time).  Of course, rebooting pfsense should be a rare thing…...    I haven't been able to solve the package lookup or version lookup yet, but I suspect that is just another floating rule.

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.