Tried load balancing today….it sorta worked.



  • I followed the multi-wan 1.2 instructions from the documentation wiki pretty much verbatim.  The only change was:

    WAN1 has a few public IP addresses.  So WAN1 interface was configured like so:
    (using private addresses as example)

    WAN1 IP:  10.0.1.220/29
    Gateway:  10.0.1.217  <–cisco 1800 routing a T1

    WAN2:

    WAN2 IP:  10.0.0.10/24
    Gateway:  10.0.0.1 <--Netopia DSL router routing an 6mb/768k ADSL link

    LAN:

    LAN IP:  192.168.0.2/24
    w/dhcp server running

    The firewall works just dandy with just WAN1 or just WAN2.  When I configure it for load balancing and follow the multi-wan 1.2 directions verbatim, it sorta works.  It will sometimes connect to external IPs and sometimes not.  When it does connect, there is a fairly pregnant pause of about 10 seconds before there are signs of life from a well connected external site like cnn.com or slashdot.

    Any suggestions?  I am using pfsense 1.2.1 (a snapshot from July 20) on fairly robust, over-engineered hardware:

    Dual P3-850
    1gig ECC SDRAM
    20gig SATA hard disk
    2 Netgear 10/100 nics (using the old DEC tulip chipset, not the Netgear crap)
    1 Linksys 10/100/1000 nic for the LAN side

    cpu utilization is low at about 2-4% and interrupts are also negligible.  The machine is passing (with only one WAN active) about 600 packets/sec which seems to be a fairly light load.  I'm assuming this isn't a hardware problem since it worked without a whimper with only a single WAN.

    Any thoughts/suggestions would be very much appreciated.

    Best,

    p.s.  If one of the pfsense whoppers wants to make some extra cash, just PM me.  I need to make this problem go away.



  • I'm not really sure what I did wrong, but decided to start again from a virgin install.  Now it seems to work OK.  I must have fat fingered something non-obvious the first time 'round.  I'm using this version:

    1.2.1-TESTING-SNAPSHOT
    built on Sat Jul 19 07:13:48 EDT 2008

    Best,


Log in to reply