Dual Wan traffic

[tomli]

Hello Everyone,

Client 1 => ISP1 => 1 st (Wan Port) ===>
                                                                  ===> PFsense (Lan Port) ====> Web Server
Client 2 => ISP2 => 2 nd (Wan Port) ===>

Can I set the  pfsense to support incoming/outing traffic to use the same wan port?  For example:-

Client 1 <=> ISP1 <=> 1 st (Wan Port) <===> PFsense (Lan Port) <====> Web Server                                                             
Client 2 <=> ISP2 <=> 2 nd (Wan Port) <===> PFsense (Lan Port) <====> Web Server

or can control the outing traffic to use which ISP company to send it out?  :D

Thanks,
Tom

[Harvy66]

I don't know about limitations of PFSense, but unless you're multihomed, it probably won't work or thing may happen in the future. If WAN1 is IP 1.1.1.1 and WAN2 is 2.2.2.2, if traffic comes in on 1.1.1.1, you can't or shouldn't be able to send out the packets from WAN2 claiming to be 1.1.1.1. If both WAN1 and WAN2 are 1.1.1.1, then in theory there should be a way.

[KOM]

What is the actual "big picture" problem you are trying to solve?  Asking specific questions without us knowing the end-goal may lead to bad advice.

[tomli]

Hi all,

In the pfsense, I set the default GW is 1.1.1.1 (1 st ISP). All the incoming traffic coming from 2 nd ISP are sent to the 1 st ISP for outgoing. Then the 1 st wan port will have high traffic load. I want to separate the traffic. Can pfsense support it?

Thanks,
Tom

[KOM]

You can use firewall rules to direct traffic to any gateway you have.  Have you read any of the Multi-WAN guide?  Gateway groups allow you to do load-balancing or failover automatically.

[tomli]

Hi,

Yes, I read it.

I tried to configure the rule in Lan Port to test it.

Interface: LAN
Protocol: Any
Source: Any
Desination: Any

Advanced features
Gateway: To Wan2

All the incoming traffic (1 or 2 wan port) are still using wan1 port for outgoing. It seem the rules cannot work properly.

Thanks,
Tom

[Derelict]

Incoming connections are going to use whatever IP address/interface DNS tells them to connect to.

All the firewall rules on LAN control are which WAN port to use for connections ORIGINATED from LAN hosts.

Return traffic for connections coming in from ISP1/ISP2 have to go out the same interface they came in on.

[tomli]

Hi All,

Attached is my network diagram  for all reference.

Now, the pfense default GW is Router B IP address. Can pfsense return the traffic to use router A? My friend told me this is called "symmetric route" in the router technology.

Thanks,
Tom

[heper]

whats the point of router A & router B ? (might have missed something)

[tomli]

Sorry, what do you mean the point of route A and B?

Router A and B are connected to ISP A and B company. For example:

Router A Lan IP is 192.168.1.1
Router B Lan IP is 192.168.1.2
PFsense IP is 192.168.1.3 and the default GW is 192.168.1.2.

I want the incoming traffic  from Router A . PFsense will send the outgoing traffic through the Router A too.

Thanks,
Tom

[heper]

well, why don't you connect your two isp's , directly to pfsense? putting 2 routers in front of pfSense(also a router), seems pointless.

also router A & router B have the same lan subnet (192.168.1.0/24) …. this is asking for trouble. you can not have multi-wan when you only have 1 WAN-interface on pfsense.
if you insist of going your double-nat way, i'd advise you to change your "lan' subnets on 1 of your routers to something different.

[tomli]

Hi,

I have one wan interface. Can I route the traffic for different IP? It is mean I can control the outgoing traffic to use which IP (NOT Default GW) for outgoing.

Thanks.

[Derelict]

What?

[tomli]

Hi,

In the Diagram, Client A use IE to browser our Web page.
Client A => Internet => RouterA=>PFSense => Web Server
Can PFSense return the data to the ClientA through RouteA?

In the Diagram, Client B use IE to browser our Web page.
Client B => Internet => RouterB=>PFSense => Web Server
Can PFSense return the data to the ClientB through RouteB?

Please advise.

Thanks.

[jahonix]

Are Route-A and Route-B supposed to hit the same web-server?
How do you separate traffic TO your 3 web servers from schematic 1?

[tomli]

Hi,

Yes, Route-A and Route-B hit the same web-server.

ISP company route the traffic to our web server. (I cannot control it).

Thanks.

[jahonix]

Is that one web server or multiple as in your first drawing?

[tomli]

Hi all,

I try to add the below configuration in my /tmp/rule.debug file manually. It can work for me. But I don't know how to add it in GUI Would you mind teaching me?

User-defined rules follow

anchor "userrules/*"

pass  in  quick  on $WAN reply-to { ( re0 192.168.5.22 ),(re0 192.168.5.21) } round-robin inet from any to any tracker 1436785528 keep state  label "USER_RULE"

If we cannot add it in GUI, can I save it permanent?

Thanks.

[Guest]

Try out using "policy based routing" to manage the internal traffic.

• The both routers are often able to work in the so called "bridged modus" only acting as a pure modem
  (figure 1)  ;)
• If not, they can be the front line where the Web Server is standing behind inside a so called "dual homed DMZ"
  (figure 2)  ::)

To reach form the outside the Web Server it is even necessary to open and forward ports,
whatever then in normal the web server will not be placed inside the LAN, that you have to open
ports directly to the LAN, there for a DMZ will be created today thats the normal and also safe way.