Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Relayd (load balancer) on the same interface

    Scheduled Pinned Locked Moved General pfSense Questions
    3 Posts 2 Posters 935 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfcomm
      last edited by

      I'm trying to set up a higly available IP to load balance between two servers on the LAN interface, with clients also connecting form the LAN inteface.

      I can do so when the traffic "flows" trough the pfsense firewall (i.e. incoming IP is on another interface than the servers), but when I set up all on the same LAN interface, I cannot connect to the tcp port which is running the service.

      So….

      This works:

      External Client –--> relayd ----> internal servers

      And this does not (in and out on the same interface):

      relayd <---- internal client
                ----> internal server(s)

      Any ideas on why and how to fix it ?

      thank you.

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        In order for that to work you'll need outbound NAT on the LAN to make the traffic appear to originate from the firewall.

        You lose the client source IP in the process but otherwise the connections won't work.

        It's always best to put the servers on a different subnet away from the clients where possible.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • P
          pfcomm
          last edited by

          Thanks for pointing this out. I had seen the syn-ack packet coming directly to the client and the RST packet send by the client because of the wrong IP… but did not think to modify the packets with the outbound nat.

          Surely works now...

          To me the loss of the source IP is not a problem (until I'll need to debug stuff), as it's from a pool of  my own servers, and the load balancer is required to prevent a single point of failure :)

          Thanks again :)

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.