Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Dual Wan traffic

    Routing and Multi WAN
    7
    19
    2850
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tomli last edited by

      Hello Everyone,

      Client 1 => ISP1 => 1 st (Wan Port) ===>
                                                                        ===> PFsense (Lan Port) ====> Web Server
      Client 2 => ISP2 => 2 nd (Wan Port) ===>

      Can I set the  pfsense to support incoming/outing traffic to use the same wan port?  For example:-

      Client 1 <=> ISP1 <=> 1 st (Wan Port) <===> PFsense (Lan Port) <====> Web Server                                                             
      Client 2 <=> ISP2 <=> 2 nd (Wan Port) <===> PFsense (Lan Port) <====> Web Server

      or can control the outing traffic to use which ISP company to send it out?  :D

      Thanks,
      Tom

      1 Reply Last reply Reply Quote 0
      • H
        Harvy66 last edited by

        I don't know about limitations of PFSense, but unless you're multihomed, it probably won't work or thing may happen in the future. If WAN1 is IP 1.1.1.1 and WAN2 is 2.2.2.2, if traffic comes in on 1.1.1.1, you can't or shouldn't be able to send out the packets from WAN2 claiming to be 1.1.1.1. If both WAN1 and WAN2 are 1.1.1.1, then in theory there should be a way.

        1 Reply Last reply Reply Quote 0
        • KOM
          KOM last edited by

          What is the actual "big picture" problem you are trying to solve?  Asking specific questions without us knowing the end-goal may lead to bad advice.

          1 Reply Last reply Reply Quote 0
          • T
            tomli last edited by

            Hi all,

            In the pfsense, I set the default GW is 1.1.1.1 (1 st ISP). All the incoming traffic coming from 2 nd ISP are sent to the 1 st ISP for outgoing. Then the 1 st wan port will have high traffic load. I want to separate the traffic. Can pfsense support it?

            Thanks,
            Tom

            1 Reply Last reply Reply Quote 0
            • KOM
              KOM last edited by

              You can use firewall rules to direct traffic to any gateway you have.  Have you read any of the Multi-WAN guide?  Gateway groups allow you to do load-balancing or failover automatically.

              1 Reply Last reply Reply Quote 0
              • T
                tomli last edited by

                Hi,

                Yes, I read it.

                I tried to configure the rule in Lan Port to test it.

                Interface: LAN
                Protocol: Any
                Source: Any
                Desination: Any

                Advanced features
                Gateway: To Wan2

                All the incoming traffic (1 or 2 wan port) are still using wan1 port for outgoing. It seem the rules cannot work properly.

                Thanks,
                Tom

                1 Reply Last reply Reply Quote 0
                • Derelict
                  Derelict LAYER 8 Netgate last edited by

                  Incoming connections are going to use whatever IP address/interface DNS tells them to connect to.

                  All the firewall rules on LAN control are which WAN port to use for connections ORIGINATED from LAN hosts.

                  Return traffic for connections coming in from ISP1/ISP2 have to go out the same interface they came in on.

                  1 Reply Last reply Reply Quote 0
                  • T
                    tomli last edited by

                    Hi All,

                    Attached is my network diagram  for all reference.

                    Now, the pfense default GW is Router B IP address. Can pfsense return the traffic to use router A? My friend told me this is called "symmetric route" in the router technology.

                    Thanks,
                    Tom


                    1 Reply Last reply Reply Quote 0
                    • H
                      heper last edited by

                      whats the point of router A & router B ? (might have missed something)

                      1 Reply Last reply Reply Quote 0
                      • T
                        tomli last edited by

                        Sorry, what do you mean the point of route A and B?

                        Router A and B are connected to ISP A and B company. For example:

                        Router A Lan IP is 192.168.1.1
                        Router B Lan IP is 192.168.1.2
                        PFsense IP is 192.168.1.3 and the default GW is 192.168.1.2.

                        I want the incoming traffic  from Router A . PFsense will send the outgoing traffic through the Router A too.

                        Thanks,
                        Tom

                        1 Reply Last reply Reply Quote 0
                        • H
                          heper last edited by

                          well, why don't you connect your two isp's , directly to pfsense? putting 2 routers in front of pfSense(also a router), seems pointless.

                          also router A & router B have the same lan subnet (192.168.1.0/24) …. this is asking for trouble. you can not have multi-wan when you only have 1 WAN-interface on pfsense.
                          if you insist of going your double-nat way, i'd advise you to change your "lan' subnets on 1 of your routers to something different.

                          1 Reply Last reply Reply Quote 0
                          • T
                            tomli last edited by

                            Hi,

                            I have one wan interface. Can I route the traffic for different IP? It is mean I can control the outgoing traffic to use which IP (NOT Default GW) for outgoing.

                            Thanks.

                            1 Reply Last reply Reply Quote 0
                            • Derelict
                              Derelict LAYER 8 Netgate last edited by

                              What?

                              1 Reply Last reply Reply Quote 0
                              • T
                                tomli last edited by

                                Hi,

                                In the Diagram, Client A use IE to browser our Web page.
                                Client A => Internet => RouterA=>PFSense => Web Server
                                Can PFSense return the data to the ClientA through RouteA?

                                In the Diagram, Client B use IE to browser our Web page.
                                Client B => Internet => RouterB=>PFSense => Web Server
                                Can PFSense return the data to the ClientB through RouteB?

                                Please advise.

                                Thanks.


                                1 Reply Last reply Reply Quote 0
                                • jahonix
                                  jahonix last edited by

                                  Are Route-A and Route-B supposed to hit the same web-server?
                                  How do you separate traffic TO your 3 web servers from schematic 1?

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    tomli last edited by

                                    Hi,

                                    Yes, Route-A and Route-B hit the same web-server.

                                    ISP company route the traffic to our web server. (I cannot control it).

                                    Thanks.

                                    1 Reply Last reply Reply Quote 0
                                    • jahonix
                                      jahonix last edited by

                                      Is that one web server or multiple as in your first drawing?

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        tomli last edited by

                                        Hi all,

                                        I try to add the below configuration in my /tmp/rule.debug file manually. It can work for me. But I don't know how to add it in GUI Would you mind teaching me?

                                        User-defined rules follow

                                        anchor "userrules/*"

                                        pass  in  quick  on $WAN reply-to { ( re0 192.168.5.22 ),(re0 192.168.5.21) } round-robin inet from any to any tracker 1436785528 keep state  label "USER_RULE"

                                        If we cannot add it in GUI, can I save it permanent?

                                        Thanks.

                                        1 Reply Last reply Reply Quote 0
                                        • ?
                                          Guest last edited by

                                          Try out using "policy based routing" to manage the internal traffic.

                                          • The both routers are often able to work in the so called "bridged modus" only acting as a pure modem
                                            (figure 1)  ;)
                                          • If not, they can be the front line where the Web Server is standing behind inside a so called "dual homed DMZ"
                                            (figure 2)  ::)

                                          To reach form the outside the Web Server it is even necessary to open and forward ports,
                                          whatever then in normal the web server will not be placed inside the LAN, that you have to open
                                          ports directly to the LAN, there for a DMZ will be created today thats the normal and also safe way.


                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post

                                          Products

                                          • Platform Overview
                                          • TNSR
                                          • pfSense
                                          • Appliances

                                          Services

                                          • Training
                                          • Professional Services

                                          Support

                                          • Subscription Plans
                                          • Contact Support
                                          • Product Lifecycle
                                          • Documentation

                                          News

                                          • Media Coverage
                                          • Press
                                          • Events

                                          Resources

                                          • Blog
                                          • FAQ
                                          • Find a Partner
                                          • Resource Library
                                          • Security Information

                                          Company

                                          • About Us
                                          • Careers
                                          • Partners
                                          • Contact Us
                                          • Legal
                                          Our Mission

                                          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                                          Subscribe to our Newsletter

                                          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                                          © 2021 Rubicon Communications, LLC | Privacy Policy