Multi-Gateway on same interface

Atlantisman · Nov 24, 2015, 11:58 PM

So,

Our ISP has given us two IP blocks with different paths to route across their network. So i would like to setup both gateways as a fail-over.

Is this possible to setup in pfsense? Is it done the same way with gateway groups with multiple interfaces?

Also, they do not support BGP, so that's not an option, but i am mostly worried about outbound traffic right now anyways.

Thanks.

Guest · Nov 25, 2015, 1:05 AM

Our ISP has given us two IP blocks with different paths to route across their network. So i would like to setup both gateways as a fail-over.

Did you get also two Internet connections from your ISP or only one with many IP addresses?

Atlantisman · Nov 25, 2015, 1:34 AM

Just one internet connection that routes through two different data centers and tier 1 providers on the ISPs network.

So not fully redundant, but it's a start.

Guest · Nov 25, 2015, 2:09 AM

FAILOVER RULES

Interfaces: Lan
Protocol: ANY
Source Address: ANY
Destination ports: ANY
Gateway;Wan1 Fail Wan2 Use

Interfaces: Lan
Protocol: ANY
Source Address: ANY
Destination ports: ANY
Gateway;Wan2 Fail Wan1 use

This would be in normal cases a Fail over rule set, but you are only owning one Internet connection
that is not so easy to realize because you should then built a fail over between two different Gateways
but they are using the same WAN port.

Derelict · Nov 25, 2015, 3:03 AM

Is it the interface that fails over or the gateway?

What if he was to assign the interface something like this:

100.200.200.2/29 gateway 100.200.200.1

And assign an IP Alias VIP to the interface, say:

100.250.250.2/29

And created a gateway of 100.250.250.1

Then a failover group of those two gateways.

Never tried it. Is your ISP's network really unreliable enough to need this? Seems they should be the ones adding redundancy, not you.

Otherwise use an outside switch and two pfSense interfaces.

Guest · Nov 25, 2015, 1:09 PM

So not fully redundant, but it's a start.

Also not the real thing, if the one Internet connection fails you will have no benefit from this point.
But for sure if this might be a real goal or benefit for your network go the way that @Derelict was
showing you. It would be the best choice to realize it like you might be able to do.