PBR from self?

[clarknova]

OPNsense 26.1.11_6-amd64

Is it possible to force gateway for traffic originating from OPNsense? I know setting a gateway on a system DNS server creates a static route to that host, but what in the case where I want to force only certain ports or protocols via policy?

I have a pair of firewalls at two locations with a layer-2 connection between them as well as a WireGuard tunnel. The WG tunnel prefers to connect via the L2 interface, but I'd like to force it to use the internet connection while still allowing other traffic to the remote host via L2.

I created a floating rule with direction 'out' on any interface, source self, WG protocol and ports, destination remote firewall, with the gateway set to WAN; and while this stopped the WG packets over the L2 connection, they didn't go out the WAN and the wG tunnel failed to pass traffic.

[userfw]

I lost a good few hours chasing a weird issue with CARP advertisement packets that weren't going to the peer from the interfaces they were supposed to go, all thanks to an overly broad PBR firewall rule towards one of the WAN gateways, so I'd say yes, you can PBR self traffic.

[franco]

It should work on rules with the out direction.  In the past that was bound to floating but I'm not sure if that's still the case.


Cheers,
Franco