meta data for this page
This is an old revision of the document!
multiwan: port forwards
Scenario:
- Interface group WAN created, to group to WAN1 and WAN2 interfaces.
- Prot forward defined from WAN to WAN:NETWORK TCP/UDP port 2196. to host 192.168.0.231:2196.
Problem:
- Connection from world to WAN1 IP port 2196 works.
- Connection from world to WAN2 IP prot 2196 doesn't work. It is correctly forwarded to LAN host, but response is sent using wrong WAN1 interface (src IP is WAN2 IP).
Debug
pfctl -s nat -v | grep 2196
It looks like outbound NAT rule is missing.
multi wan: lan gw was chosen
If gateway switching is used, it is needed to set all not WAN gateways as forced down.
System –> Settings –> General –> Allow default gateway switching
If the link where the default gateway resides fails switch the default gateway to another available one. When using default gateway switching use any available gateway or select a specific gateway group below.
System –> Gateways –> Single –> … –> Mark Gateway as Down
static route from LAN to LAN not working
Problem is that all outgoing traffic on LAN interface is using LAN gateway (autodetected)
cat /tmp/rules.debug pass out route-to ( bge0 192.168.0.242 ) from {bge0} to {!(bge0:network)} keep state allow-opts label "let out anything from firewall host itself" pass out route-to ( em1 85.222.100.29 ) from {em1} to {!(em1:network)} keep state allow-opts label "let out anything from firewall host itself" pass out route-to ( em0 95.143.241.141 ) from {em0} to {!(em0:network)} keep state allow-opts label "let out anything from firewall host itself"
There are two additional gateways in LAN (bge0) (for OpenVPN remote networks): 192.168.0.231 and 192.168.0.242. From unknown reason OPNSense choose 192.168.0.242 as gateway for non LAN traffic. This firewall rule overrides correct static routing:
netstat -nr 192.168.251.235/32 192.168.0.231 UGS bge0
As workaround, firewall rule is needed to force output gateway.
correct workaround
Firewall –> Settings –> Advanced: Tick Disable force gateway (Outgoing packets from this firewall on an interface which has a gateway will normally use the specified gateway for that interface. When this option is set the route will be selected by the system routing table instead.)