Gateway priority and status not respected in routing table

Started by zubrick, December 12, 2025, 06:56:05 PM

Previous topic - Next topic
Hello,

I am migrating to an OPNsense firewall and have an issue with the routing table.
I've set up 3 IPSec VPNs with a vti interface on each and a corresponding gateway and different priorities on each.
IP monitoring is working correctly on all three gateways and interfaces of disconnected tunnels are quickly marked as down.

The problem is that the static route I add on those gateways are inserted in the routing table regardless of the gateway status or priority, leaving routes on inactive tunnels.
I've tried all the parameters in the gateways.

I saw there are gateway groups, but I cannot put routes on them, only use them in firewall policies which solves the issue if the connections is initiated from the OPNsense side, but still creates asymmetric routes if the connections is initiated from the other side.

Am I missing something ? Is there an option for it to work?
It seems to work correctly with the two default gateways.

UPDATE:
After some tests it seems OPNsense doesn't like to have two routes to the same subnet on two different gatways and acts completely random in that case.
This is the first firewall on which I am not able to do that.
This is really a basic feature for a route based VPN.

The current workaround will be to take advantage of the routing engine more specific route priority and divide the subnets in two on preferred VPN gateway.
So for exemple 10.20.30.0/25 and 10.20.30.128/25 on the primary vpn and 10.20.30.0/24 on the secondary one
This is a lot of work and is really error prone, but I don't see anything else.
And then it still doesn't solve my issue because I need to go disable the routes manually, because OPNsense doesn't remove route of a disabled gateway?????