Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Https problems

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    5 Posts 2 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mgiammarco
      last edited by

      Hello,
      I have a network with pfsense 2.1.5 and dual wan in load balancing.
      Due to the load balancing bug explained in another thread I had to jump on 2.2beta.
      Now load balancing seems to work.
      But several people are not able to access to https sites. For example all people use gmail on https. After some time half of them cannot access gmail (blank page, random error etc.)

      I supposed that it was a dual wan related problem but even when I disable second wan problem persists.

      Can you help me?

      Is is a beta problem? Is is not?

      Thanks,
      Mario

      1 Reply Last reply Reply Quote 0
      • M
        mgiammarco
        last edited by

        I notice now that I have automatic nat but automatic rules are created only for first wan. Is it ok?

        1 Reply Last reply Reply Quote 0
        • P
          phil.davis
          last edited by

          It should generate the automatic NAT for every interface that has a gateway set (=WAN). Now in 2.2 there is hybrid NAT mode. You might have had manual outbound NAT set in 2.1.5 and so it is now stuck on just the manual NAT that is there. Maybe try deleting any NAT rules that it has and going back to just automatic. Look in /tmp/rules.debug and search for "NAT" to find what rules it really has implemented.
          If the users are load-balancing between 2 WANs then:

          1. If one of the WANs does not have NAT applied, then half the time their connections will not work.
          2. If a state times out when using Google mail etc, (like they do nothing for a while), then when the browser gets going again the comms might go out the other WAN. Google will see the comms coming from a different public IP and might make them login again…
            If that is happening, then put special traffic like this into a failover group - i.e. make it normally stick to 1 of the WANs. Happens a bit with email or banking sites that do not like the user switching around their public IP during a logged on session.

          As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
          If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

          1 Reply Last reply Reply Quote 0
          • M
            mgiammarco
            last edited by

            Hi again and thanks.
            Now I have checked nat and is all ok.
            I have tried also with failover and sticky connections but problem persists.
            What can I do? Can it be a bug?

            Thanks,
            Mario

            1 Reply Last reply Reply Quote 0
            • M
              mgiammarco
              last edited by

              Updating to latest beta and putting https only on wan1 have solved the problem. I close the post.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.