Multi-wan question

[Jyling]

Hello, members,

Is it possible, and how can it be done, if some outbound connections need to use a certain gateway?
My organization has a router that's been using a single gateway 1, and I've just added gateway 2:

gateway group
gateway 1: igb0 -> pppoe0 (priority 254) -> provider 1, weight 1, tier 2
gateway 2: igb1 -> dhcp (priority 1) -> provider 2, weight 5, tier 1

Now, all outbound connections route through gateway 2 (unless I bring it down), but the goal is for some to use the old gateway 1.
They will be the outgoing SMTP connections from our mail server and SIP/RTP from our phones on the LAN. All of the browsing, FTP, Teams, etc. should use GW2.

How can/should this be set up?

Thank you for your help!

[Monviech (Cedrik)]

You could set up a firewall rule that matches before your gateway group rule, match https traffic as destination, and set the explicit gateway you want for it.

[Jyling]

You could set up a firewall rule that matches before your gateway group rule, match https traffic as destination, and set the explicit gateway you want for it.

I apologize but I do not follow your instructions.
Particularly, I do not understand what HTTPS has to do with my question or what the destination is.

EDIT: Could this be achieved by outbound NAT? It seems somewhat relevant, to my uneducated guess, but I never used it so don't know.

[viragomann]

Could this be achieved by outbound NAT?

No, outbound NAT does not route traffic.

HTTPS might haven been a mistake. Create an alias of type ports and add the SMTP and SIP ports to it.
Then add a firewall rule to the LAN, at destination select any and at port specify the alias you've created before, go down to gateway and select gateway1.
Save it and move this rule up to the top.

Instead of the destination ports you can also specify certain source IPs if this is more eligible for your use case.

[Monviech (Cedrik)]

I forgot to put e.g., before HTTPS, it was meant as a general pointer, sorry. :)

Best check out our docs too to understand Policy Based Routing:

https://docs.opnsense.org/manual/how-tos/multiwan.html

[Jyling]

Then add a firewall rule to the LAN, at destination select any and at port specify the alias you've created before, go down to gateway and select gateway1.
Save it and move this rule up to the top.

Instead of the destination ports you can also specify certain source IPs if this is more eligible for your use case.

This did it:
Action pass
Interface LAN
Direction in
Protocol TCP
Source single host/net, the IP of the SMTP server
Destination port range the port type alias
Gateway GW1

Perfect, thank you so much!

[Jyling]

Thinking about it, what works so well for SMTP won't work for VOIP because port type aliases do not accept port ranges. SIP port range that we use is 5060-5090, and RTP is 10000-20000. Are there any tricks to support that?

[Patrick M. Hausen]

Use "5060:5090" for a range.

It's documented. 😉

https://docs.opnsense.org/manual/aliases.html

[Jyling]

Use "5060:5090" for a range.

It's documented. 😉

https://docs.opnsense.org/manual/aliases.html

Ah, I see! Instead of the dash, port range uses colon. That explains why I saw 'invalid port'. It's not a very common range delimiter but works anyway.

Thanks for the tip!