PfSense interface and routing

[rcilink]

OK, what am I missing with this?!?

I have a pfSense system setup with multiple interfaces.

Interface 1: LAN
Interface 2: Internet (FiOS, configured with a gateway address)
Interface 3: Private fiber WAN ***

A machine on the LAN can get out to the Internet and works well. The Interface 3 (Private fiber WAN) is not setup with a routing switch, so there is not a 'gateway' for the subnet. The best description would be a traditional home network with a Linksys router. Yes, it has a gateway, but the linksys router does not know to route back (can't gain access to linksys).

The Linux firewall I am replacing with pfSense was able to work with the Private fiber WAN because the interface was setup to not have a gateway address.  It simply dumped traffic with that subnet on that interface. (I know, seriously bad… but out of my control).

How can I do something similar on pfSense?

Effectively, it needs to route 172.20.0.0/16 to Interface 3, without any gateway.  I found some BSD commands to manipulate from the console but it does not stick.  Has someone had this issue and already found a solution to get pfSense working in this manner?

[antillie]

In proper routing a route is literally just a destination network range and the gateway used to reach that network range. So you can't have a route without a gateway.

Dumping traffic onto an interface is known as a connected network and is using ARP, not routing, to handle traffic. So if you want pfSense to send traffic bound for 172.20.0.0/16 to interface 3 without a gateway then you need to give pfSense an IP in this range on interface 3 and make sure there are no layer 3 devices between pfSense and the client machines on this network.

I suppose you could put a proxy ARP device of some kind between pfSense and the 172.20.0.0/16 network and then create another /16 subent between pfSense and the proxy ARP device, but that would just make things complicated.