Multi WAN load balancing vlan - Traffic goes always out through default IF

[dash]

Yes I did. On each modification.

[OPNenthu]

Ok, thanks.

I'll step back and see if something comes to me, though I'd also be very happy if someone else showed me what I missed.  I'm doing this for learning opportunity.

[dash]

A big thanks to you.

[Oriann]

Reply to is not working as intended and devs are playing hide-n-seek. Just look at my issue and how I spend time to reproduce it but nobody gives a sh*t here.

Related: https://github.com/opnsense/core/issues/9806

[franco]

Well, I'm not hiding. Your problem scope fits our support offering but clearly exceeds community support due to the lack of code-bound evidence and not many other people having the issue, which could also mean it is local to you and then it would only be solvable with local analysis which we don't do in community scope.


Cheers,
Franco

[dash]

On my side, with OpenWRT, I could get the working setup as with Sophos UTM, incoming traffic to one interface going out to the same one despite load-balancer. Don't understand why it's not possible with OpnSense.

[Oriann]

Well, I'm not hiding. Your problem scope fits our support offering but clearly exceeds community support due to the lack of code-bound evidence and not many other people having the issue, which could also mean it is local to you and then it would only be solvable with local analysis which we don't do in community scope.


Cheers,
Franco

Hi there, just to clarify I have found out this bug really by luck. There is the problem if you have almost same speed dual WAN then it looks like its all working fine so nobody cares(many services dont mind assymetric routing). If I would not set up traffic shaper I would never found out that upstream traffic is going elsewhere. You know the bug is kinda hidden so maybe thats why nobody cares because their infrastructure "just works". I am really tring to sell this on forums and convince somebody to test more but I feel like nobody have time to test this even when I have provided reproduction steps...So sorry for my dissapointment this way.

[JonH]

I was having a similar problem with a dual WAN HA configuration running 26.1.7, but it only seemed to affect the secondary firewall. I couldn't connect to the Wireguard VPN on the secondary firewall via the non-default WAN2. I think my default WAN1's ISP blocked the response packets as I never received them. After reading through this thread I set the Reply-To to the WAN2's gateway on the rule on the WAN2's interface allowing the incoming Wireguard traffic and it started working. After configuring the similar settings for the WAN1 wireguard rule I'm now able to connect to either firewall's wireguard on either WAN.

Jon