Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Reply from lan going to wrong interface

    Scheduled Pinned Locked Moved Routing and Multi WAN
    3 Posts 2 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nicknack
      last edited by

      I have attached this image for clarity, i hope someone can point me what i'm missing here..

      So i have this pfsense acting as shaper and router between 2 ISP,
      on This shaper default gateway is pfsense box going to ISP 1.
      P.S : ISP 2 doesn't provide their router, we have to provide ourself, hence the 1 extra Linux Router on ISP2

      Linux Router ( 192.168.1.5 ) routing :
      route 192.168.110.10 via 192.168.1.2

      PFSense Shaper :
      192.168.110.0/24 via 192.168.10.253
      ( 192.168.10.253 is L-3 Switch )

      Now there is one webserver on LAN that i want to be able to access from ISP 2 ( 5.6.7.8 ),
      all routing is done, i can see the packets going in from 5.6.7.8 to 192.168.110.10
      BUT,
      packets from Webserver is caught on PFSense box firewall log for ISP 1..

      I have added advanced LAN Rules on PFsense Shaper specifying 192.168.1.5 GW…
      but the reply from webserver still get caught on ISP 1's log...

      Hope someone can help...

      Thanks..

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        3 routers on the same broadcast domain as you have there can get ugly with any stateful firewall. Moving one of those to a diff interface would make your life easier.

        You can work around it though. The reason the traffic is getting routed the way it is, either route-to, or reply-to. In a scenario like that, you need to disable reply-to unless you move one of those next hops to another interface. Can disable reply-to globally (Sys>Advanced) or on a per-rule basis.

        1 Reply Last reply Reply Quote 0
        • N
          nicknack
          last edited by

          Hi..
          thanks for your answer,
          yes i think i'd rather add another interface on the shaper box,
          so i don't need to add more tuning to pfsense..

          SO basically i should just use
          e.g : Add interface 192.168.2.1 for shaper ,
          and replace 192.168.1.5 with 192.168.2.2 on the linux router box,
          Am I correct ?

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.