Hello,
I need some help with a static route towards the WAN Interface.
Not working case (It's still using default GW 192.168.0.254 on WAN Interface):
netstat -rn
Internet:
Destination Gateway Flags Netif Expire
default 192.168.0.254 UGS vtnet0
10.9.8.0/24 192.168.0.101 UGS vtnet0
10.10.10.0/24 link#4 U vtnet3
10.10.10.1 link#4 UHS lo0
127.0.0.1 link#7 UH lo0
192.168.0.0/24 link#1 U vtnet0
192.168.0.100 link#1 UHS lo0
192.168.0.254 50:6b:8d:69:48:1d UHS vtnet0
192.168.100.0/24 link#2 U vtnet1
192.168.100.1 link#2 UHS lo0
traceroute 10.9.8.9
traceroute to 10.9.8.9 (10.9.8.9), 64 hops max, 40 byte packets
1 192.168.0.254 (192.168.0.254) 0.667 ms 0.555 ms 0.559 ms
2 10.136.55.229 (10.136.55.229) 9.384 ms 9.054 ms 8.653 ms
Working Case to another interface (It timed out because the network is not behind the interface:
netstat -rn
Internet:
Destination Gateway Flags Netif Expire
default 192.168.0.254 UGS vtnet0
10.9.8.0/24 192.168.100.110 UGS vtnet1
10.10.10.0/24 link#4 U vtnet3
10.10.10.1 link#4 UHS lo0
127.0.0.1 link#7 UH lo0
192.168.0.0/24 link#1 U vtnet0
192.168.0.100 link#1 UHS lo0
192.168.0.254 50:6b:8d:69:48:1d UHS vtnet0
192.168.100.0/24 link#2 U vtnet1
192.168.100.1 link#2 UHS lo0
traceroute 10.9.8.9
traceroute to 10.9.8.9 (10.9.8.9), 64 hops max, 40 byte packets
1 192.168.100.110 (192.168.100.110) 0.518 ms 0.366 ms 0.363 ms
2 * * *
Example with 10.0.0.0/8 to null interface.
OK. Only Route to Null Interface and its blocked, connected interfaces ok:
netstat -r
Internet:
Destination Gateway Flags Netif Expire
default 192.168.0.254 UGS vtnet0
10.0.0.0/8 localhost UGSB lo0
10.10.10.0/24 link#4 U vtnet3
traceroute 10.10.10.20 --> ok, direct connected
traceroute to 10.10.10.20 (10.10.10.20), 64 hops max, 40 byte packets
1 10.10.10.20 (10.10.10.20) 0.404 ms 0.267 ms 0.200 ms
traceroute 10.9.8.9 --> ok, not direct connected, only default route
traceroute: findsaddr: failed to connect to peer for src addr selection.
Not OK. Route to Null interface and more specific route:
netstat -r
Routing tables
Internet:
Destination Gateway Flags Netif Expire
default 192.168.0.254 UGS vtnet0
10.0.0.0/8 localhost UGSB lo0
10.9.8.0/24 192.168.0.101 UGS vtnet0
10.10.10.0/24 link#4 U vtnet3
OPNsense link#4 UHS lo0
traceroute 10.9.8.9 --> wrong next hop
traceroute to 10.9.8.9 (10.9.8.9), 64 hops max, 40 byte packets
1 192.168.0.254 (192.168.0.254) 0.631 ms 0.525 ms 0.546 ms
2 10.136.55.229 (10.136.55.229) 16.491 ms 18.481 ms 10.514 ms
3 172.16.20.110 (172.16.20.110) 11.915 ms 11.994 ms 11.989 ms
4 172.16.20.109 (172.16.20.109) 11.808 ms 11.396 ms 11.711 ms
traceroute 10.8.8.9 --> ok, not direct connected, only default route
traceroute: findsaddr: failed to connect to peer for src addr selection.
traceroute 10.10.10.20 --> ok, direct connected
traceroute to 10.10.10.20 (10.10.10.20), 64 hops max, 40 byte packets
1 10.10.10.20 (10.10.10.20) 0.425 ms 0.280 ms 0.150 ms
I ran into a similar problem and the solution for me was to create another firewall rule
to allow from the lan subnets
with the destination subnet of the static route
via the desired gateway of the static route.
And it must be applied before the default lan to wan via default gateway rule.