Dual WAN with pfsense

pfsense is a FreeBSD router OS that can be installed on embedded systems or PC/Server PC hardware. Its a free, open source customized distro based off of FreeBSD 7 specifically tailored for use as a firewall and router. Its one of the most secure router OS’s out there. Large corporation and universities use this router OS because of the stability, failover, and stacking capabilities. If you have heard of M0n0wall or IPCop then you should have an idea what pfsense is.

For my use I used the same exact hardware that I used to build the IPCop router that I reported on 3 posts ago.

List of Features

Firewall

State Table

NAT

Redundancy

Load Balancing

VPN

IPsec

RDD Graphs

And More. For a full listing see the complete features site

I will show you how to enable Load Balancing with Dual WAN on your pfsense router. Some may ask why would you need Dual WAN. Failover, incase you have mission critical data that needs to be accessed at all times like off site backup and for load balancing. Load balancing will balance the load (or bandwidth use) between your Internet links. Many companies do this to decrease latency and to get more bandwidth for many users while saving money.

I will assume you have pfsense loaded and you have already setup two WAN connections on your firewall.

  • Once this is complete visit services -> load balancer

image

  • Delete any pools that are there that do not work
  • Click image to enter a new pool.
  • Enter a pool name and description
  • Set the type to gateway

image

Now we need to add a monitor IP for the router to monitor the link status of the pool.

  • For the Monitor IP select WAN Gateway
  • In the Interface Name field choose WAN and click Add to Pool

image

  • Now Go back to Monitor IP and Select your OPT1’s Gateway
  • In the Interface Name Field choose OPT1 and click Add to Pool

image

You should see that the WAN gateway has a different gateway address then the OPT1 gateway. If not then pfsense will not work correctly. You will have to put a bridge between that interface to ensure pfsense has two different gateways. If you have trouble with this please contact me. Basically pfsense does not support the same gateway on multiple networks right now.

  • Click Save

Now go to Status -> Load Balancer to see if everything is working fine. It should report Online.

image

If you followed my directions and it does not show online after 15 minutes then that gateway may not respond to ICMP traffic. For your monitor IP use 4.2.2.1 which is an any cast DNS Server.

We must create NAT rules now.

  • Go to Firewall -> Nat -> Outbound
  • Enable AON

image

You should have a rule in there for the WAN to any Gateway already. This is automatically created. Now you need to enter one for OPT1

  • Click Add and Copy the WAN setup but the Interface will now be OPT1

image

  • Apply the Changes.

From here it may work but you may need to make one more change.

  • Go to Firewall -> Rules -> LAN
  • Edit your existing LAN net entry. Modify the gateway from default to the Load Balancer

It should look like

image

Your Done! What you can do to check to see if Load Balancing if working properly is try to go online. If you can get to Google then your Connection is working properly. Go to http://pfsense.org/ip.php and click refresh a couple of times. Your Public IP should switch back and forth. This means that load balancing if working. The reason your public IP should change is because the Load Balancing Feature works in a Round Robin fashion. Every new session is will oscillate between gateways. This also means that if you test your Internet Connection speed on www.speedtest.net you will not see the combined speed of both networks. You will see the combined speed when you use applications that use multiple sessions like peer to peer applications.

EDIT: if you have problems with the pools being uneven and you cannot figure it out even after deleting the pool and starting over flowing my directions then please see Greg’s comments below. He used Google and Yahoo as the Ping IP and configured the Pool using the “other” option.

EDIT2: Comments by SAM:

1. Go to System\routing. On the gateways tab add a gateway for each of your interfaces, eg: WAN and OPT1

2. Under System\routing. On the groups tab create a group and assign each gateway the priority of “Tier 1″, the trigger can be “member down”

3. Go to Firewall\rules. On the LAN tab, edit the default rule. Press the button for “Gateway” under advanced features and change it to the name of the gateway group you created in step 2.

You should be up and running.

This was confusing to find since dual wan was moved from Services\Loadbalancer to the System|Routing tab. Monitor IP’s are now configured on the gateway tab.

Edit 15 Mar 10: changed IP addr link to http://pfsense.org/ip.php

68 Replies to “Dual WAN with pfsense”

  1. Many thanks to you.

    Now i can use my 2 poor adsl connections and join them to one “real” adsl connection.

    Regards

  2. Hi there,

    very nice article, it makes implementing load balancing easy. I was concerned about setup but it’s a piece of cake thanks to you!

    My customer, a hotel, currently has a Linksys RV042 router that is used for load balancing for the guest network, it’s worked fine for a few years but is now getting too congested, so I am implementing a Netgate router running pfsense. I am setting up the pfsense for captive portal and load balancing, and everything is working great so far in my test network.

    They have a lot of business clients and I’m concerned about the clients VPNs, which I think like to have only one connection and don’t like round robin type connections.

    Should I implement sticky connections or ? The end object of course is as few tech support calls as possible, and high reliabilty of the guest connections, no matter what protocols they use.

    Also both my public IP addresses are on the same subnet so I need to insert a router between opt1 and the ISP, which also works fine. Is that going to be an issue with VPN etc? I’m going to use a DIR 615 router that I have handy.

    Any other suggestions would be greatly appreciated.

    Thanks!

  3. Hey Bill,
    I wouldn’t do sticky connections unless you think you absolutely need it. I don’t go to hotels expecting everything to work, nor do I even take the time to complain when I can’t do something simple like SSH out.

    As far as the VPN, the VPN will only use WAN1 so no issue there, just put the second NAT device on WAN2.

    My other suggestion is to check out the pfsense forum. I have seen other people setting up a hotel deployment on the forums in the past and the topics might give you more ideas or answer any more questions you may have.

  4. Thanks for the info. I’m looking into the forums now. It’s always fun trying out new gear, and I hope it works as well as it should. Time will tell!

    Thanks again!

  5. Hi Tom,

    Just dropping by to say thanks for the article. I had a “blast” trying to figure out why things weren’t working for me.
    I am having a network related project for school and high availability is on the priority list. So i was wondering if you have any suggestions on what to have in case the router doing the load balancing fails, like having a backup one to take the load. I was thinking something in the line of having another pfsense router and making a pfsync connection in between, but i am not 100% convinced that is the best avenue(only seeing CARP clusters using it).

    Anyway this working made my day. Thank you very much!

  6. hi,brother Tom
    I have two internet connections of different ISP. they use dynamic ip addressing and different proxy, one for auto detect and one for ‘ygncache.mpt.net.mm’ setting and need authentication for internet access.
    I configure as above and use proxy setting by browser but still can’t access internet. I can login for internet access with this configuration. How can I configure pfsense with squid proxy and load balancing for those ISPs.

  7. Hello, Tom.

    I found Your pages on Google, and i really do appreciate Your web pages. Loads of very good information. Thank you for the effort.

    I am a network administrator, working on a networking project, involving a couple of pfsense firewall, running in a VMWare ESXI environment. I have to set up WAN failover on one of the pfsense firewalls. I have tried “everything”, including everything in your guide, and many other guides on the web, but with no luck. I have reached the limit of my capabilities, and do not know any further steps to take to get this working.

    I looks like you have a high level of knowledge about pfsense. Is it possible to enlist some help from You? If You could provide me Your email, we can perhaps communicate by mail or MSN. It would also be possible to set up a teamviewer session to my ESXi test environment.

    Please contact me by mail or MSN. Thank you in advance.

  8. Guys, Tom provided an article to help a certain situation out. I know he didn’t write it to cover all possible scenarios you guys are posting. Go to the forum as he hinted MANY times or pay him or pfSense for Support if you want more help. Begging for help is pathetic…

    Good job on the article Tom, it has helped me in my own setup. pfSense rocks!

  9. Hi Tom, interesting and very useful site you have.
    I’m planning to install pfsense and use this feature of combine two wan’s (can I call it ‘broadband bonding’?) My question is, can I do this with dynamic IP’s? Since I have two DSL’s connected over PPPoE.
    Thanks in advance.

  10. With respect to a different gateway for load balance, I’ve read that a router can be used on one of the static IP (bridged IPs) and that would enable a different gateway although technically further up, they share a common gateway.

    Although I don’t get that if I set the router up say static, assign the wan & lan, what is the actual gateway address for that router?

  11. I have question lets say that I setup a pfsense with Dual WAN.. I have two internet service provider on WAN1 and WAN2 what will happen if the ISP1 encounters poor service and drop connection… Will everyone connected on the network will use the WAN2 automatically as the internet service provider and PFSense will automatically re-route all traffic to WAN2->ISP2…

  12. Hello,
    I have a serious problem trying to add 2 more lines to the five I already have working in the loadbalancer. All are from the same provider, but as soon as I add one of them to the loadbalancing pool, after 10 seconds or so, all monitor IPs go offline.

    I have 2 PFSense firewalls with 2 netgear FS726T smartswitches (for hardware redundancy) and getting the same results on both of them.

    By themselves the new lines seem to work just fine. I’ve had dhcp turned off on both
    Can you help me out?
    Raoul

  13. Please let me know if you’re looking for a author for your weblog. You have some really good articles and I believe I would be a good asset. If you ever want to take some of the load off, I’d love to write some material
    for your blog in exchange for a link back to mine.
    Please send me an email if interested. Thank you!

  14. Do you mind if I quote a few of your articles as long as I provide credit and sources back to your website?
    My blog is in the exact same niche as yours and my visitors would truly benefit
    from some of the information you provide here. Please let me know if
    this alright with you. Thanks!

  15. Do not be in a hurry to take on the very first bid straight away.
    Where VPN is concerned, often the best VPN for Hulu, is onewhere you’ve paid for the service.
    In most cases, people would simply turn their systems
    off whenever they feel that the temperature is already suitable for what they need.

  16. Right here is the right site for anybody who wants to understand this topic.
    You know a whole lot its almost tough to argue with you (not
    that I really will need to…HaHa). You definitely put a new spin on
    a topic that’s been written about for a long time. Excellent stuff, just wonderful!

  17. Superb blog! Do you have any helpful hints for aspiring writers?
    I’m planning to start my own blog soon but I’m a little lost on everything.
    Would you recommend starting with a free platform like WordPress or go for a paid option?
    There are so many choices out there that I’m totally overwhelmed .. Any suggestions? Bless you!

Leave a Reply

Your email address will not be published. Required fields are marked *