In this tutorial you will learn how to configure pfSense to load balance and fail over traffic from a LAN to multiple Internet connections (WANs) i.e. dual wan.
Why and how to setup a dual wan router?
A dual wan setup allows you to increase your internet bandwidth. You can load balance traffic as per your needs. You can get internet connection redundancy and failover. If one connection goes down your traffic will be routed automatically to a backup connection.
Requirements
Two internet connections from two different ISPs. You can mix-match ADSL/FTTH/4G LTE/Cable/T1/FIOS connection as per your needs.
- pfSense router with three network ports (NICS).
- Two ISP modems with network port (NIC)
- Static or dynamic IPs from ISPs
- Monitor IP # 1 for ISP # 1 – 8.8.8.8 (google dns IP)
- Monitor IP # 2 for ISP # 2 – 208.69.38.205 (opendns IP)
Our sample setup
- I have two ISP modems+routers with dynamic IP address assigned.
- You need to connect each modem with pfsense using an Ethernet connection.
- You need to connect a network switch to pfsense using an Ethernet connection.
- All systems/servers/printers/wifi on LAN uses 172.16.1.254/24 subnet with 172.16.1.254 as a default gateway.
Configuration
Before starting, make sure all of the WAN-type interfaces are enabled with static IP WANs and with a gateway set as described above.
Step 1: Configure pfsense LAN interface
Open pfSense web interface using http://172.16.1.254/ > Interfaces > LAN and set it as follows as per (fig.01):
Step 2: Configure pfsense wan01 interface (ADSL ISP #1)
Open pfSense web interface using http://172.16.1.254/ > Interfaces > WAN 01 and set it as follows as per (fig.01):
Step 3: Configure pfsense wan02 interface (ADSL ISP #2)
Open pfSense web interface using http://172.16.1.254/ > Interfaces > WAN 02 and set it as follows as per (fig.01):
Step 4: Confirm both gateways are online
Once both gateways have been defined, visit Status > Gateways:
Step 5: Configure monitor IP for each gateway
Visit System > Routing > Select Gateways tab and you will see a screen as follows with private IP set as monitor IP for each gateway:
Next, click on edit gateway icon (button) for WAN_ADSL2_L2 (ADSL ISP # 2) and set monitor IP to 208.69.38.205:
The gateway configuration has been changed. The changes must be applied for them to take effect. So click on the Apply Changes button.
Step 6: Configuring dual WAN link load balancer
Finally, you are ready to configure the pfSense as a Load Balancer by visiting System > Routing > Select the Gateway Groups > Click the “Add” button:
- Set Group Name to “WanLoadBalancer“.
- Set Gateway Priority for both gateways to “Tier 1“. Please note that when two gateways are on the same tier (e.g. Tier 1), they will load balance. This means that on a per-connection basis, connections are routed over each WAN in a round-robin manner. If any gateway on the same tier goes down, it is removed from use and the other gateways on the tier continue to operate normally.
- Set Trigger Level to “Memberdown“.
- Set Description to “My Dual ADSL Wan Link Load Balancer“
- Finally click the “Save” > “Apply Changes” button.
Step 7: Configuring link fail over
Next, configure the pfSense as a failover for wan connections by visiting System > Routing > Select the Gateway Groups > Click the “Add” button:
- Set Group Name to “ADSLLinkFailover2“
- Set Gateway Priority wan_adsl2_l1GW (ISP 1) to “Tier 1“
- Set Gateway Priority wan_adsl2_l2GW (ISP 2) to “Tier 2“
- Set Trigger Level to “Member down“
- Set Description to “Link failover for ADSL 1“
Set link failover for ADSL 2 as follows and swap Gateway Priority:
Step 7: Configuring the firewall rules for load balancer
You need to pass traffic to these LBs using the Gateway setting on firewall rules. Click on Firewall > Rules > Lan > Add and set it as follows:
Fig.11: LB firewall rule
Click the “Save” > “Apply Changes” button to save firewall rules.
Step 8: Configuring the firewall rules for failover
You need to pass traffic to these failover gateways using the Gateway setting on firewall rules. Click on Firewall > Rules > Lan > Add and set it as follows:
Fig.12: Failover firewall rule for ISP 1 /ADSL 1 link
Set gateway to ADSLLinkFailover1
Step 9: Client configuration
Make sure you assign all the IP addresses in the following range to your client computers:
- Network: 172.16.1.254/24
- IP ranges: 172.16.1.1 to 172.16.1.253
- Default gateway: 172.16.1.254
- DNS server: 172.16.1.254 (or 8.8.8.8/8.8.4.4)
Test it as follows from client system (I’m using OpenBSD):
$ ifconfig vio0
$ netstat -nr -f inet
$ ping -c 2 google.com
$ host cyberciti.biz 172.16.1.254
Sample outputs:
Fig.13: Testing your pfSense LB/Failover router
$ python speedtest-cli
If one internet connections goes down, you will be still connected via failover.
What next?
You will get the wan (internet) connection redundancy and load balancing but not the router redundancy. Your internet connection will go down, if your pfSense router failed due to hardware problems. This draw back can be addressed using router redundancy setup.
🐧 Get the latest tutorials on Linux, Open Source & DevOps via:
- RSS feed or Weekly email newsletter
- Share on Twitter • Facebook • 31 comments... add one ↓
Category | List of Unix and Linux commands |
---|---|
File Management | cat |
Firewall | Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04 |
Network Utilities | dig • host • ip • nmap |
OpenVPN | CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04 |
Package Manager | apk • apt |
Processes Management | bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time |
Searching | grep • whereis • which |
User Information | groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w |
WireGuard VPN | Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04 |
“tire” -> “tier”
Thanks for the heads up!
It’s important to note that the setup, above, should have a Static IP address assigned, by the ISP. Most business accounts will include a few Static IPs (anywhere from 3 – 16 addresses), as part of the service agreement.
However, if you’re trying this on a private ISP connection, you’ll either have to ask your ISP for as Static IP address. Or you’ll have to config your WAN interface to grab an address via DHCP, first. And, then, either use ‘as-is’.
Or, reconfigure the WAN interface to use the DHCP address as a static address.
[NOTE: Grabbing an IP via DHCP, then entering it as a ‘Static IP’, will BREAK your configuration, in the event that your ISP updates their network, or there is a long-term power outage…. or just anything that may cause your ISP Modem (or pfSens) to refresh the DHCP Lease.]
How does this setup handles nat? If there is a web server or ftp server working within the internal network will it continue to work if one of the ISPs goes down? Is there a specific way to configure nat/rules if the user wants to host email or web services behind that router?
Can we add as many WAN connections as we want( within hardware limits)?
Yes. Just add new gateway groups and firewall rules for each of the conditions in which you would want to operate the firewall.
For example if you had three ISP connections –
Gateway group – runs all three connections
Gateway group – isp1 fails
Gateway group – isp2 fails
Gateway group – isp3 fails
Gateway group – isp1 & isp2 fails
Gateway group – isp1 & isp3 fails
Gateway group – isp2 & isp3 fails
Nice tutorial! just one thing, the SSL traffic, I’ve noticed problems with apps like banking and CPanel, last one complains “same session with 2 differents IPs” and you get to the login page again, personally I separate the SSL traffic from HTTP using source port in the firewall rules and using failover rules like you show us for SSL only.
Again very nice tutorial!
Francisco
Hi !
I believe “failover” is useless on the latest pfsense version
if load balance have only two WANs.
can you confirm ?
Also, some servers may generate problems if using two different IP when accessing them.
Do you know some solution else than the “stick to ip” on the general options ?
I have now 3 gateway groups, one load balancer and two failover.
I’m about to configure the firewall rules.
What should be the order of these rules, or is it optional??
Thanks! :)
I have the same question… Does rule order matter for failover and load balancing? Which should be on the top?
hi,
May i ask also if i need a wan load balancer if i want to separate a browsing traffic from other traffic. like gaming..
Noop. You just need to set firewall rules.
Hi after setting everything it seems to work, but if for example I disconnect my wan1 cable I cannot browse anything from the lan via my wan2, if I do a ping disgnistic on the second wan it will send the packets ok, am I missing soemthing?
Regards
For anyone having this issue I resolved it by going to firewall > lan > edited the lan rule and added on gateway Wanloadbalancer
Sorry this did not fix anything I am still having trouble to browse from the lan, and this only made a combine of the 2 ISPs having difficulties since Ip changes a lot.
thank you for this nice tutorial! Helped me a lot! In Step 7 and 8 there are two different Firewall > Rules > Lan > Add. One “Add” adds on top, the other on the bottom. As I remarked, the position is also important. Mabye you could add a screenshot in the end whith the positions of the firewall rules.
would like to know how i should add firewall rukles with this setup i have a email server on the lan network and i have a dyndns running to to auto update to the best external ip at the time how can i setup the firewall tio send and receive the email ports over this load balance rule?
Hi
Can you update this tutoriul for connect 3g modem? Please
Sometimes the WAN connections aren’t of the same bandwidth. so in this case the WEIGHT option is useful (System->Routing->Gateway) edit the gateway and in Advanced Option set a Weight.
Hi Vivek Gite,
Good Day,
May I know?
Can pfsense :
1. give me bandwidth BONDING or AGGREGATION OR ADD bandwidth
eg.
If I have 8 dynamic ip WAN that is asymmetrical with such speeds of : upstream = 50Mbps , downstream = 100Mbps
this is the maximum link speed that I can subscribe at my current location.
I have 100+ cpu/windows PC for gaming purposes
location = malaysia post code 75450
meaning will pfsense give me 400Mbps upstream bandwidth and 800Mbps downstream bandwidth?
thus provides 4Mbps for each PC of upstream speed/bandwidth
this is my primary router
I may face a challenge of getting 8 PCI Ethernet card slots PC to work on pfsense.
does pfsense works with usb/lan adapter to use as wan?
Is there a hardware appliance, pfsense with 8 WAN?
can I also configure in same network a backup router (secondary) with dedicate 4 WAN of similar specs above so when any of the 1st pfsense WAN fails or its router fails, 2nd router with separate WAN will take over.
can I also configure pfsense secondary router to return to primary router as soon as the outage at primary router is restored?
which linux flavour works best with pfsense?
i hope you can assist me. (newbies)
thank you so very much.
best regards,
/kt yeo
Is failover completely seamless ?
Can we do a demo uaing skype call and during call disconnect the primary ISP to see that switch over to secondary ISP is seamless if call progresses without any disruption.
Thanks for the article is very useful for me.
I’ve a doubt, I need to configure only the failover group on my pfsense because the load balanced is not necessary; can i skip this step or failover can’t work without load balancer rule?
yes, you can skip it.
Don’t we need DNS firewall rule too? Otherwise it won’t work.
Nice tutorial.
But is it necessary that the connection interfaces of the ISPs will be ethernet ? is it not possible to do it with vlan interfaces?
You can use PPPoE, VLAN and many other options as all of those supported by pfSense.
Thank You very much Dear..
Hello!
I have a big problem with SIP 5060 and VoIP traffic. Firstly, what I have observed, pfSense does not make real Load Balancing. Not send traffic on both WAN interfaces simultaneously. But not this is a big problem. The call is disrupted. If I reenable the previous primary WAN interface, the voice is hearing well. But it primary WAN link down calls are not switched to secondary WAN link. I have disabled also Reply-to-WAN… but does not work.
Any idea for this scenario: Dual-WAN on pfSense without disrupting the calls initiated from LAN?
Thank you in advance!
Take a look at Configuring NAT for VoIP Phones https://docs.netgate.com/pfsense/en/latest/recipes/nat-voip-phones.html and https://docs.netgate.com/pfsense/en/latest/multiwan/index.html
Nice tutorial. I have two Internet connections from the same Internet provider. It seems that only one of the connections is allowed to go online. I have no problems setting up failover and loadbalance when using different ISPs
Can you I setup this on pfsense ?
Going to try this… And throw IPsec VPNs in the mix. If I setup 2 VPN connections using the 2 links – would those load balance properly? :)