Bug? MultiWAN sending packets on wrong interface

[knebb]

Hi,

I have a Multi-WAN setup an configured it according to the documentation.

Now I tried to access my OPNSense Web-GUI on the configured port from Internet (WAN), but it failed on one of the interfaces.

After checking evry related items a packe capture revealed the reason why it fails:

OPNSense answers th request on the WAN1 interface with the (correct) source IP of the WAN1 interface but sends the packet out on WAN2 which is a different ISP and thus a different IP network. The ISP then obviously drops the packet with the wrong source IP.

Here's the result of the packet capture. ROTDSLDIREKT with $DSLIP is WAN2 and ROT with $GFIP is WAN1.

Code Select Expand


Schnittstelle Zeitstempel SRC DST output
ROTDSLDIREKT pppoe0 2023-12-04 10:50:35.769841 length 48: $GFIP.8443 > $INETPC.37505: tcp 0
ROTDSLDIREKT pppoe0 2023-12-04 10:50:35.942055 length 48: $GFIP.8443 > $INETPC.37507: tcp 0
ROTDSLDIREKT pppoe0 2023-12-04 10:50:37.984069 length 48: $GFIP.8443 > $INETPC.37505: tcp 0
ROT igc1 2023-12-04 10:50:34.751383 84:b8:02:e2:1d:40 dc:58:bc:e0:5c:60 IPv4, length 60: $INETPC.37505 > $GFIP.8443: tcp 0
ROT igc1 2023-12-04 10:50:34.879659 84:b8:02:e2:1d:40 dc:58:bc:e0:5c:60 IPv4, length 60: $INETPC.37507 > $GFIP.8443: tcp 0 

Any ideas how to fix?
Or is this a bug?
BTW: I already asked in the German forum but I guess it is a very special topic so I did not get any reply.

/KNEBB

[iMx]

Firewall -> Settings -> Advanced:

Disable reply-to on WAN rules

With Multi-WAN you generally want to ensure traffic leaves the same interface it arrives on, hence reply-to is added automatically by default. When using bridging, you must disable this behavior if the WAN gateway IP is different from the gateway IP of the hosts behind the bridged interface.

Did that get enabled?

[knebb]

Hi,

I checked this and is was on the defualt setting (unticked).

I just re-checked what was going on on my system and it turned out, meanwhile (definitely no manual change!) the packets go out on the correct interface and I can connect through both Multi-WAN IPs.

Do not ask me what was wrong when I did the capture....

/KNEBB

[meyergru]

Wrong thread, sorry...