Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    MultiWan, multiLan problem

    Routing and Multi WAN
    3
    7
    1591
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      LonelyWolf last edited by

      Hi all, i'm having problems reaching a single address from lan to lan2 after enabling multiwan for failover in pfsense 2.1

      This is the case:

      Interfaces all static ip
      LAN = 10.71.9.x
      LAN2 = 192.168.1.x
      WAN = VLAn configured and working, with default gateway
      ADSL = standard ADSL, i want use this only if WAN is not working

      Gateways:
      GW_WAN (default)
      AdslGateway -> to the adsl router monitor ip is 8.8.8.8

      Groups:
      FailOver-> WAN Tier1,AdslGateway Tier 2, Trigger Level Member Down

      System -> Advanced -> Miscellaneus: check on Allow default gateway switching

      Firewall -> Rules
      No floating rules, no WAN rules, no ADSL rules
      LAN2: only a rule to pass to LAN

      LAN:
      Anti-Lockout Rule, as default
      A rule to pass traffic to my isp smtp, default gateway
      A rule to block everything on port 25, default gateway
      "Default allow LAN to any rule", default gateway

      If i change "Default allow LAN to any rule" gateway to use the group Failover i can't reach any address in LAN2

      If I add a rule:
      source LAN (address or subnet)
      destination LAN2 (address or subnet)
      gateway default

      before "Default allow LAN to any rule" (gateway Failover group) i can't reach LAN2

      Can anyone help me?
      Thanks

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        And per the multiwan guide - which could prob use some update.. But

        https://doc.pfsense.org/index.php/Multi-WAN_2.0
        When a firewall rule directs traffic into the gateway, it bypasses the firewall's normal routing table. Policy route negation is just a rule that passes traffic to other local or VPN-connected networks that does not have a gateway set. By not setting a gateway on that rule it will bypass the gateway group and use the firewall's routing table. These rules should be at the top of the ruleset – or at least above any rules using gateways.

        Can you post screenshots of your rules - screens make it so much easier to make sure everyone is on the same page of understanding what the rules are saying and what order they are in.

        Unless you only have 1 lan, your going to need rules above your rule that points to your multiwan gateways - so that you can use your normal routing table to access other lan networks.

        phil just put up this great post, that needs to get put into the docs
        http://forum.pfsense.org/index.php/topic,69318.msg384723.html#msg384723

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

        1 Reply Last reply Reply Quote 0
        • L
          LonelyWolf last edited by

          Thanks fo your answer, Here some screenshots. (I've already read that guide.)

          Status.png: pfsense box connections
          LAN.png: LAN firewall rules, i can't reach LAN2
          LAN2rules.png:just a rule to pass traffic from LAN2 to LAN (but now its not working!)

          LANWorking.png: with these rules i can reach LAN2

          Edit:
          If i change the LAN last rule ("Default allow LAN to any rule ") destination as not LAN2 address or not LAN2 subnet or not Single Host (static ip on LAN2) i can't reach LAn2 anyway.








          1 Reply Last reply Reply Quote 0
          • L
            LonelyWolf last edited by

            Maybe i found the solution, i'll do more tests but i can ping a lan2 address with these!

            Added 2 floating rules:

            action pass, interface lan, source lan subnet, destination lan2 subnet, protocol any
            action pass, interface lan2, source lan2 subnet, destination lan subnet, protocol any

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              You have NO rules in LAN that would allow traffic to LAN2

              Your source is "LAN address" that is PFSENSE IP address, not clients on pfsense lan network.  Your last rule that has lan net which is correct sends everything to your gateway.

              As already gone over put the correct rules on your interfaces before the GATEWAY rules for your multiwan and your good.  Which is what your doing with the floating rules.

              Your LAN2 rules is wrong as well - you have spelled out pfsense LAN address as source, not the lan2 network.


              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

              1 Reply Last reply Reply Quote 0
              • T
                tim.mcmanus last edited by

                LAN net to LAN2 net
                LAN2 net to LAN net

                See screenshots of the setup I'm using.  Works like a charm.

                ![Screen Shot 2013-12-17 at 6.06.40 PM.png](/public/imported_attachments/1/Screen Shot 2013-12-17 at 6.06.40 PM.png)
                ![Screen Shot 2013-12-17 at 6.06.40 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-12-17 at 6.06.40 PM.png_thumb)
                ![Screen Shot 2013-12-17 at 6.06.48 PM.png](/public/imported_attachments/1/Screen Shot 2013-12-17 at 6.06.48 PM.png)
                ![Screen Shot 2013-12-17 at 6.06.48 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-12-17 at 6.06.48 PM.png_thumb)

                1 Reply Last reply Reply Quote 0
                • L
                  LonelyWolf last edited by

                  Thanks to both of you, it was my fault.

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post