[Tutorial] Bridged Modem Access with Balanced Multi-Wan.

[Davesworld]

At current I am running OPNSense 18.7_1 with dual wans and the gateway group set up as balanced (yes streaming movies and other downloads DOES aggregate the speed to double in balanced mode) with two DSL modems each running in bridge mode.

First, you need to find out what the modem's fixed IP for maintenance is. I deliberately set my second modem's permanent LAN ip to a different subnet, eg my first modem uses 192.168.2.1 and my second I set at 192.168.1.1. Now keep track of which modem is on which wan and create a virtual IP for each wan in the same subnet as THAT wan port's modem, I used 192.168.2.2 on wan1 and 192.168.1.2 on wan2 as virtual IP addresses. I set two firewall rules in Floating Rules that allow lan net (I don't want wlan to access the modem) to go to 192.168.2.1/32 and a second rule to 192.168.1.1/32. The subnet only allows access through the wans to that IP only irrespective of the actual wan ip to access the internet.

Then I set my NAT outbound to hybrid and added two rules, one for each wan that sets the destination address to single host using the network rather than a specific ip eg 192.168.2.0/30 and 192.168.1.0/30 for the second rule. In the Translation Target you will see the virtual WAN IP you created for that WAN in the dropdown menu for that wan. Select it, save them and you're done!

I should note that with a single wan, I was able to access the modem with only a virtual IP and through the proxy. The proxy is useless in a multiwan balanced gateway group and I really have no need otherwise.

[Davesworld]

Screenshot

[Davesworld]

Screenshot

[Davesworld]

Now in the why not department, a few shots of the modems main pages.

[frauhottelmann]

Thank you. I have been trying to do this all day :D

[NewGuyLOLs]

I'd like to chime in, as this should be in the official documentation in getting modem access - it took several hours of trying other guides and resetting configs until I found this guide. One qualm now is just that the Virtual IP configuration has been moved from Firewall -> Interfaces.

The original poster's tutorial still works for 22.1(.6) on an apu2e4 connected to a fiber modem/ONU. However, your subnet for the Virtual IP may need to be changed to /24, as it did for me.

Thank you, OP.

[flash99]

I was trying to follow this tutorial, but the problem is that I don't see the virtual IP I defined as a drop down option under "Translation / target"  when I try to define Firewall: NAT: Outbound
Any idea what I did wrong ?

[cookiemonster]

yep, you seem to have missed the most important part. You need to create it first.
...

At current I am running OPNSense 18.7_1 with dual wans and the gateway group set up as balanced (yes streaming movies and other downloads DOES aggregate the speed to double in balanced mode) with two DSL modems each running in bridge mode.

First, you need to find out what the modem's fixed IP for maintenance is. I deliberately set my second modem's permanent LAN ip to a different subnet, eg my first modem uses 192.168.2.1 and my second I set at 192.168.1.1. Now keep track of which modem is on which wan and create a virtual IP for each wan in the same subnet as THAT wan port's modem, I used 192.168.2.2 on wan1 and 192.168.1.2 on wan2 as virtual IP addresses. I set two firewall rules in Floating Rules that allow lan net (I don't want wlan to access the modem) to go to 192.168.2.1/32 and a second rule to 192.168.1.1/32. The subnet only allows access through the wans to that IP only irrespective of the actual wan ip to access the internet.

Then I set my NAT outbound to hybrid and added two rules, one for each wan that sets the destination address to single host using the network rather than a specific ip eg 192.168.2.0/30 and 192.168.1.0/30 for the second rule. In the Translation Target you will see the virtual WAN IP you created for that WAN in the dropdown menu for that wan. Select it, save them and you're done!

I should note that with a single wan, I was able to access the modem with only a virtual IP and through the proxy. The proxy is useless in a multiwan balanced gateway group and I really have no need otherwise.

[flash99]

I'm not a huge Opnsense expert, but I still know how to follow instructions.

Of course I created it and I made sure it's there

[cookiemonster]

Ok then.
I have a virtual IP for something else. It does show for me in the drop down. Sorry, no idea what could be wrong for you then. Did you check is a /32 ip? Mine is as that is what I need.

[flash99]

Here are the Virtual IP settings and the Translation / target dropdown

[cookiemonster]

Do you really need it to be /30 ? If not, change it to /32 and see if that does it for you.

[flash99]

Yes I don't really need /30
I originally made it /32 , but then when I saw its not showing up I tried to change it to /30 just to make it the same as in the original post to see maybe it will help

[flash99]

I think its related to this https://forum.opnsense.org/index.php?topic=32587.0

[cookiemonster]

It seems indeed, good spot! I'm glad I'm still on 22.7