Topics

Hello, I have 2 WAN connections (handled by 2 different opnsenses cluster in different buildings, ie 4 opnsenses in 2 clusters) and a DMZ handled but another opnsense cluster. I would like to make a port-forward from both WAN connections to the same server:

Code Select Expand

   pubip1                                        pubip2
-----------                                  -----------
|  ISP-1  |                                  |  ISP 2  |
-----------                                  -----------
      |                                            |
------------          -------------          ------------
| FW-WAN-1 |----------| FW-DMZ-IN |----------| FW-WAN-2 |
------------   vlan1  -------------   vlan2  ------------
                             | vlan10
                        ------------
                        |  SERVER  |
                        ------------

I can enter from both pubip to the server (port forward OK on WAN openses) but reply (ack packet) goes only to one connexion (to vlan2 in my case).

I tried to play with Sticky connexions, States by interface. I also tried to set local tag on vlan1 incoming packet on FW-DMZ-IN to match reply packets and add a policy routing rule but it seems to be ignored.

Is it possible to do that ? Does anyone has tips ?