The "NOT" checkbox…

[jaredadams]

http://i.imgur.com/JagT1X1.png

Does that check box also apply to the Desintation Port Range section right below it?

I want to use a firewall rule to direct port 80/443 out one wan, and then EVERYTHING else, (using a NOT 80/443 rule) out another WAN.

Possible? Or is there another way to do this?

[DerBachmannRocker]

You can take a look "uner the hood" to see for yourself what rules are being generated from the GUI data. Go to "Diagnostics" -> "Commandline". Execute the command

pfctl -sa

This will dump the rules file to the screen that is internally used by the PF firewall. I ticked the box on a rule, applied the change and dumped it. Here is what I got:

pass quick on em0 inet proto tcp from 10.222.0.0/16 to ! <hostinfrastructserversold>port 1025:5000 flags S/SA keep state label "USER_RULE: Test Rule"

According to this page that explains PF firewall syntax, you can put a NOT in front of the destination port. But PFSense does not expose this feature, so you are screwed.
http://www.openbsd.org/faq/pf/filter.html

You could do the abomination I put as attachment. Or (much better style) use 2 separate rules. Unfortunately I have no experience with PFSense + 2 WANs. Maybe you need to look at Policy Routing instead of firewall rules…

</hostinfrastructserversold>

[Nachtfalke]

The "NOT" does not work for the ports on the GUI.

But you do not need this. Rules will be affected from TOP to DOWN.
So your first rule is the rule which allows traffic for port 80 and 443 on WAN1.
Your second rule allows all traffic with all ports on WAN2. This is working because if there comes traffic with destination port 80/443 it will hit the first rule and use this rule. It will never hit the second rule.

Hope this will help you.

[jaredadams]

But wouldnt this rule have to be on the LAN interface and use the gateway option?

If I put this rule on the WAN interface for outbount traffic will the WAN rule redirect traffic to another way.

Since the NOT rule doesnt apply to ports I was thinking of creating aliases for "TRAFFICWAN1" and give it port 80 and 443
Then make another alias "TRAFFICWAN2" and have aliases for 1:79, 81:442, and 444:65500

Then make a rule on the LAN interface that directs each alias out the appropriate WAN.

This sound right?

[Nachtfalke]

What you say is correct.

What I meant in my post with WAN1 and WAN2 is the gateway. I didn't explaint that correct.
The rules - of course - must be on the LAN interface.