New WAN failover configuration sort of works

[bob9999]

I have a problem setting up wan failover / load sharing.

Specifically, it seems to work acceptably when I leave a few steps out but dns fails if I follow all the steps that are commonly recommended.

I can't even log into 192.168.1.1:3000 (adguard home) when the final steps are attempted. Although 192.168.1.1 for Opnsense access works normally.

I have 2 gateway groups, Failover and LoadBalance. I have 2 but will probably settle on LoadBalance. Monitor IP addresses are correct.

Manually shutting one down fails over correctly to the other. Setting both WAN priorities the same seems to let the router decide. LoadBalance is RoundRobin Sticky on the gateway group. Currently, WAN1 is priority 254 and WAN2 is priority 255. 'Allow default gateway switching' makes no difference checked or unchecked.

As soon as I put a gateway group, either one, in the LAN rule everything chokes. No dns. Nothing gets fixed if I add a DNS rule above the LAN gateway rule.

Everything springs back to life when I remove the Gateway from the LAN.

Along the way I discovered DNS speeds up considerably when I stopped using unbound and allowed Adguard Home to be the sole DNS forwarder. That configuration stays. Unbound and DNSMasq are both disabled. I have some DNS servers also listed on the main system general page, FWIW.

Internets are Comcast and T-Mobile 5G. CGNAT from TM appears to work great double natted. T-Mobile is 192.168.12.1 from them as WAN2 address.

Question: Should I leave well enough alone? Or is there a way to make all the known and recommended configuration steps work as described in almost every article I can find on the subject?

[viragomann]

As soon as I put a gateway group, either one, in the LAN rule everything chokes. No dns. Nothing gets fixed if I add a DNS rule above the LAN gateway rule.

Seems you made the same mistake as another guy recently. Look here: Setting up WAN failover

[bob9999]

Thanks. I read this as try it again and then reboot. Ok.

Edit.

I played around with the dns rule and it finally accepted the /32 address without the gui telling me it didn't exist. I have the rule set to inactive until I have the time to go at it again.  Maybe Thursday.