Multi-Gateway on same interface



  • So,

    Our ISP has given us two IP blocks with different paths to route across their network. So i would like to setup both gateways as a fail-over.

    Is this possible to setup in pfsense? Is it done the same way with gateway groups with multiple interfaces?

    Also, they do not support BGP, so that's not an option, but i am mostly worried about outbound traffic right now anyways.

    Thanks.



  • Our ISP has given us two IP blocks with different paths to route across their network. So i would like to setup both gateways as a fail-over.

    Did you get also two Internet connections from your ISP or only one with many IP addresses?



  • Just one internet connection that routes through two different data centers and tier 1 providers on the ISPs network.

    So not fully redundant, but it's a start.



  • FAILOVER RULES

    Interfaces: Lan
    Protocol: ANY
    Source Address: ANY
    Destination ports: ANY
    Gateway;Wan1 Fail Wan2 Use

    Interfaces: Lan
    Protocol: ANY
    Source Address: ANY
    Destination ports: ANY
    Gateway;Wan2 Fail Wan1 use

    This would be in normal cases a Fail over rule set, but you are only owning one Internet connection
    that is not so easy to realize because you should then built a fail over between two different Gateways
    but they are using the same WAN port.


  • LAYER 8 Netgate

    Is it the interface that fails over or the gateway?

    What if he was to assign the interface something like this:

    100.200.200.2/29 gateway 100.200.200.1

    And assign an IP Alias VIP to the interface, say:

    100.250.250.2/29

    And created a gateway of 100.250.250.1

    Then a failover group of those two gateways.

    Never tried it. Is your ISP's network really unreliable enough to need this? Seems they should be the ones adding redundancy, not you.

    Otherwise use an outside switch and two pfSense interfaces.



  • So not fully redundant, but it's a start.

    Also not the real thing, if the one Internet connection fails you will have no benefit from this point.
    But for sure if this might be a real goal or benefit for your network go the way that @Derelict was
    showing you. It would be the best choice to realize it like you might be able to do.


Log in to reply