Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense as a router and default gateway with multiwan

    Scheduled Pinned Locked Moved Routing and Multi WAN
    35 Posts 7 Posters 34.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bravo_prochu
      last edited by

      Gateway is on my LAN interface… so there is no 'gateway' for LAN int..

      What does it change ? Because I still don't get it..

      I would like to use multiwan tutorial, so when I specify default gateway in rules ('multiWAN' = PPPoE1 [tier1] and PPPoE2 [tier1]) there is no traffic to routers..
      (on attachement i don't  have created multiWan gateway yet but i already tried it)

      staticRoutes03.jpg
      staticRoutes03.jpg_thumb

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        "What does it change ? Because I still don't get it.."

        If there is a gateway on the interface - pfsense thinks its a WAN, and will auto nat it for starters.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • B
          bravo_prochu
          last edited by

          There is no gateway on LAN interface, but still when I change default gateway on FIREWALL-RULES-LAN…alias..- gateway to multiWAN instead of default - there are no traffic

          staticRoutes04.jpg
          staticRoutes04.jpg_thumb

          1 Reply Last reply Reply Quote 0
          • P
            phil.davis
            last edited by

            Not sure where you are up to, but here are the general principles when you have some internal networks and multi-WAN with gateway groups…

            1. Define a gateway for each other internal router (gateway) that leads to an internal network that is NOT directly connected to pfSense.
            2. Define a static route to each of these internal networks pointing to the correct internal gateway.
            3. Add gateway group(s) that group together your real public WANs in whatever tiers you wish.
            4. First add rules on LAN to pass traffic to the the internal networks - without specifying any gateway in the rules - the packets will be passed to the ordinary routing table and the static route/s you defined will get them to their destination.
            5. If you have VPN site-to-site links to other offices, these also need to use the ordinary routing table - put pass rules for traffic to subnets that are across the VPN, and let the ordinary routing table and VPN software deal with it.
            6. Further down in the LAN rule list, put rules that send traffic to particular gateway groups (e.g. near or at the end you might commonly have a rule that passes all protocols source LANnet destination any gateway LoadBalanceGWG - to load balance everything that did not match any previous special rule)
              Some screen shots attached of one of my setups, with a test Firebox internally that goes to various test subnets in 10.99.0.0/16. The LAN rule passing INF_Subnets to INF_Subnets matches this Firebox traffic (among other stuff). INF_Subnets is an alias that contains all my internal subnets, local to pfSense, at the same office and across VPNs at other offices. This makes it easy to write 1 pass rule that lets all this internal private traffic pass through to the ordinary routing table, before any rules that pump traffic into a gateway or gateway group.

            Gateways.png
            Gateways.png_thumb
            Static-Route.png
            Static-Route.png_thumb
            GWGroups.png
            GWGroups.png_thumb
            LAN-Rules.png
            LAN-Rules.png_thumb

            As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
            If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              ^exactly – needs to be turned into a doc..  If I find time tmrw at work (its been slow normally as we get closer to holidays) I will do just that ;)

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • B
                bravo_prochu
                last edited by

                Thanks for Your answers Guys !

                Still have some questions
                I use limitters for every aliases (clients) (att.  staticRoutes06) on my network; My LAN rules looks like (att.  staticRoutes05)
                Instead of 'Private_devices' (block private devices to outside DNSserver) can I use all local subnets ??
                Do 'Inf_Subnets' have LAN subnet included ? (pfsense box IP) ?

                Can You help me with this ?

                How to drop any other stations to the Internet (but aliases..) and still have local connections to the lan routers/Access points using multiWAN..

                Can You point me a basic firewall isolation for that kind of policy ?

                staticRoutes05.jpg
                staticRoutes05.jpg_thumb
                staticRoutes06.jpg
                staticRoutes06.jpg_thumb

                1 Reply Last reply Reply Quote 0
                • P
                  phil.davis
                  last edited by

                  Instead of 'Private_devices' (block private devices to outside DNSserver) can I use all local subnets ??
                  Do 'Inf_Subnets' have LAN subnet included ? (pfsense box IP) ?

                  I have lots of different LANs, so I made some aliases like:
                  'Private_Devices' = IP address ranges that I give out to private devices on the LAN (like people's smart phones…)
                  'Inf_Subnets' = all the private subnets in my private extended network (includes LAN subnet and others)
                  Then I can make easy rules to block or pass traffic to or from these groups of IP address subnets.
                  If you just have 1 LAN subnet, then it is easy to just make rules like:
                  Block UDP+TCP source LAN subnet, destination !LAN IP port DNS (53)
                  That stops LAN clients getting DNS from anywhere else outside pfSense LAN.

                  As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                  If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                  1 Reply Last reply Reply Quote 0
                  • B
                    bravo_prochu
                    last edited by

                    Thanks for an explanation;
                    So, i should use this rule at the top of my others ?
                    then, the 'inf_subnets' and then - my 'aliases rules' ?

                    As I wrote before I use one rule for one alias - to use bandwidth per IP tutorials; Right now my rule is - alias to 'any' [any port], but when first set to exclude 53 port to any devices on LAN subnet then i should use only [alias to any - DNS port (with multiWAN gateway)] rule ?

                    staticRoutes07.jpg
                    staticRoutes07.jpg_thumb

                    1 Reply Last reply Reply Quote 0
                    • P
                      phil.davis
                      last edited by

                      Yes, that rule (assuming it has "Block" selected at the top) goes up the top of your list. It will stop any port 53 (DNS) packets that are not going to the pfSense LAN address. So people won't be able to access other DNS servers out on the internet - they will have to use DNS provided by pfSense (or be extra tricky to find other ways around it).

                      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                      1 Reply Last reply Reply Quote 0
                      • B
                        bravo_prochu
                        last edited by

                        Hi
                        Tried to do exactly as You wrote, but it doesn;t work.
                        I have to add rule any to any at the bottom of all my rules, can You help me understand why ?
                        If I disable it - win7 gives me an 'Internet' access massage but there is no traffic to it

                        staticRoutes08.jpg
                        staticRoutes08.jpg_thumb

                        1 Reply Last reply Reply Quote 0
                        • P
                          phil.davis
                          last edited by

                          You often want a quite permissive rule at the end that feeds "ordinary" traffic into Multiwan GWG. That way most ordinary traffic ends up in the Multwan GWG, which you want. That is like your 2nd last rule, but the 2nd last rule has something special as source (which I can't read/guess since it is partly rubbed out). You need to modify the 2nd last rule so it actually passes traffic from all the sources you wish (maybe all of LANnet?) into Multiwan. Then the last rule is not needed.

                          As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                          If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                          1 Reply Last reply Reply Quote 0
                          • B
                            bravo_prochu
                            last edited by

                            My goal is to pass traffic ONLY from devices included in aliases… (partly rubbed out)
                            I dont use dhcp serwer on pfsense. I would like to block all traffic exept aliases.. I guess there is something wrong in that policy because when i set a static ip - there is an Internet on it.. (even if ip is not in aliases list)
                            what rules should I use ?

                            1 Reply Last reply Reply Quote 0
                            • P
                              phil.davis
                              last edited by

                              If you remove that last "pass all" rule, then (assuming there are no other rules like that) you will be just passing the things specified in the various aliases used in rules. If someone sets their IP address to one that is passed, they get internet. Set it to some other IP, then it will be blocked by the unseen default block rule (or whatever other block rule that might match before that). You really need to first know exactly what you want blocked and passed, then look through your rule list from top to bottom, think through what IP addresses are in which alias and make rules in order that will have the effect you want.

                              As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                              If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                              1 Reply Last reply Reply Quote 0
                              • B
                                bravo_prochu
                                last edited by

                                To easly modify network policy I would like to only add new rule with alias for example 'newCustomer' like in my pictures above;
                                In that line I have IP or IPs of newCustomer devices (included in alias - newCustomer), set default gateway - 'MultiWAN' and  set limiters: newCustomerUP and newCustomerDown - to specify bandwidth
                                For every single customer I would like to create that kind of rule to define different UP/DOWN speed (I add 2 limiters for every alias in my network)
                                Is there any other way to do that ? Is it possible that the limiters slowing down speed traffic between lokal routers ?

                                1 Reply Last reply Reply Quote 0
                                • B
                                  bravo_prochu
                                  last edited by

                                  Hello phil.davis !

                                  Can You help me to understand one more thing..
                                  I followed Your instructions and it works !! But i can't understand what is going on with traffic ballancing.
                                  I have 2 pppoe WANs 80/8Mbit vDSL2 and basically works only one of them (attach)
                                  Is it normal bahaviour ?

                                  I have chacked 'use sticky connections'

                                  best regards
                                  bp

                                  ![PFSense multiWAN 01.png](/public/imported_attachments/1/PFSense multiWAN 01.png)
                                  ![PFSense multiWAN 01.png_thumb](/public/imported_attachments/1/PFSense multiWAN 01.png_thumb)
                                  ![PFSense multiWAN 02.png](/public/imported_attachments/1/PFSense multiWAN 02.png)
                                  ![PFSense multiWAN 02.png_thumb](/public/imported_attachments/1/PFSense multiWAN 02.png_thumb)
                                  ![PFSense multiWAN 03.png](/public/imported_attachments/1/PFSense multiWAN 03.png)
                                  ![PFSense multiWAN 03.png_thumb](/public/imported_attachments/1/PFSense multiWAN 03.png_thumb)
                                  ![PFSense multiWAN 04.png](/public/imported_attachments/1/PFSense multiWAN 04.png)
                                  ![PFSense multiWAN 04.png_thumb](/public/imported_attachments/1/PFSense multiWAN 04.png_thumb)

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    phil.davis
                                    last edited by

                                    The load balancing is random. So if you have just 1 client doing a big download, then that will go on 1 of the links and you will see the graph like this. But if you have many clients doing things, then it should usually average out to use both links about equally (with each gateway weight 1, like you have).
                                    The general pass rule on every LANn needs to specify gateway MultiWAN. Maybe there are some rules on your LAN/s that are matching traffic but not specifying gateway MultiWAN?

                                    As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                    If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      bravo_prochu
                                      last edited by

                                      The thing is that i have many users behind routers (without nat)
                                      My LAN rules looks like this (att)
                                      subnets_inf - aliases with my networks subnets, the rest are single rule-row for each alias - client

                                      Have You any idea ?

                                      ![PFSense multiWAN 05.png](/public/imported_attachments/1/PFSense multiWAN 05.png)
                                      ![PFSense multiWAN 05.png_thumb](/public/imported_attachments/1/PFSense multiWAN 05.png_thumb)

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        phil.davis
                                        last edited by

                                        On those rules for the individuals to any - "beep", "AdamekIrena"… - you need to have gateway MultiWAN selected (in the advanced section of the rule page) - that will show in the Gateway column. I can't see that in the screen shot because the alias popup box is covering it.

                                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bravo_prochu
                                          last edited by

                                          Yes, I have it
                                          For every single rule - gateway as multiwan and in/out pointed…

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            phil.davis
                                            last edited by

                                            That should work - but I haven't really looked hard on my systems to see if a limiter (In/Out) and load-balanced gateway group works together as it should. (The devices I have on limiters are in failover gateway groups, so they only get fed to 1 gateway at a time.) I will try the load-balanced gateway  limiter combination at work tomorrow.
                                            You could see if the limiter is causing a problem - take the limiter off a rule and see if the corresponding subnet starts to load-balance.
                                            Can anyone else confirm if this combination works for them?

                                            As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                            If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.