[SOLVED] V2.1.3 Local services reply only via default gw?

  • For the unaware:

    Do not use floating rules, the reply-to flag will NOT be added automatically. Just use the per-interface rules, this resolved the problem.


    I have a dual WAN setup, each WAN has the correct gateway configured, one gateway is set as default gateway, no load balancing or grouping in place. Sort of like this:

    WAN1 has GW1; GW1 is the default gateway
    WAN2 has GW2

    On both WAN1 and WAN2, I have ports mapped to internal services, via port forward. All works fine - by fine, I mean that the connections are stuck to the interface they originally arrived on - for example:

    Internal HTTP service: Connection initiated on WAN2:80, packet forwarded to internal HTTP, reply packet sent back to the source via GW2. All good, confirmed with tcpdump.

    However, when I have a local service on PFSENSE, bound to <any>or even to WAN2, all reply packets are sent via WAN1 and GW1. For example:

    SSH service bound to <any>: Connection initiated on WAN2:22, but reply packet sent via WAN1 and GW1, with the source address of WAN2 ?!. Confirmed with tcpdump.

    Is there any way I can tell PFSENSE to send also the traffic handled by locally bound services via the correct interface and gateway?


  • Some more data:

    If the initiator is PFSENSE, then the connection is correctly handled - so if I use telnet -s WAN2_address, the packets go out and return via the correct gateway (GW2). It seems that only locally bound services are affected.