Multi-WAN Caveats and Considerations¶
This section contains the caveats and considerations specific to multi-WAN in pfSense.
Multiple WANs sharing a single gateway IP¶
Because of the way pf handles multi-WAN connections, traffic can only be directed using the gateway IP address of a circuit, which is fine for most scenarios. If the firewall has multiple connections on the same ISP using the same subnet and gateway IP address, as is common when using multiple cable modems, an intermediate NAT device must be used on all but one of them so that pfSense sees each WAN gateway as a unique IP address.
When using the NAT device, it can be configured to forward all traffic back to pfSense which can help with using that WAN for other services. However, some protocols, such as VoIP, will have problem if they use a WAN with NAT in such a configuration.
If at all possible, contact the ISP and have them configure the WAN circuits such that they are in different subnets with different gateways.
One exception to this is a PPP type WAN such as PPPoE. PPP type WANs are capable of having the same gateway on multiple interfaces, but each gateway entry must be configured to use a different monitor IP address (See Monitor IP).
Multiple PPPoE WANs¶
When multiple PPPoE lines from the same ISP are present and the ISP supports Multi-Link PPPoE (MLPPP), it may be possible to bond the lines into a single aggregate link. This bonded link has total bandwidth of all lines together in a single WAN as seen by pfSense. Configuration of MLPPP is covered in Multi-Link PPPoE (MLPPP).
Local Services and Multi-WAN¶
There are some considerations with local services and multi-WAN, since any traffic initiated from the firewall itself will not be affected by policy routing configured on internal interface rules. Traffic from the firewall itself always follows the system’s routing table. Hence static routes are required under some circumstances when using additional WAN interfaces, otherwise only the WAN interface with the default gateway would be used.
In the case of traffic initiated on the Internet destined for any WAN interface, pfSense automatically uses pf’s reply-to directive in all WAN-type interface rules, which ensures the reply traffic is routed back out the correct WAN interface.
The default settings for the DNS Resolver require Default Gateway Switching to work properly with Multi-WAN. See Default Gateway Switching for details. As an alternative to using default gateway switching, a few changes can be made to make the DNS Resolver more accommodating to Multi-WAN, including enabling forwarding mode. The details are described later in this chapter.
The DNS servers used by the DNS forwarder must have gateways defined if they use an OPT WAN interface, as described later in this chapter. There are no other caveats to DNS forwarder in multi-WAN environments.
DynDNS entries can be set using a gateway group for their interface. This will move a DynDNS entry between WANs in failover mode, allowing a public hostname to shift from one WAN to another in case of failure.
IPsec is fully compatible with multi-WAN. A static route is automatically added for the remote tunnel peer address pointing to the specified WAN gateway to ensure the firewall sends traffic out the correct path when it initiates a connection. For mobile connections, the client always initiates the connection, and the reply traffic is correctly routed by the state table.
An IPsec tunnel may also be set using a gateway group as its interface for failover. This is discussed further in Multi-WAN Environments.
OpenVPN multi-WAN capabilities are described in OpenVPN and Multi-WAN. Like IPsec, it can use any WAN or a gateway group.