Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a network set-up using two pfSense routers arranged like this:-

DMZ1  WAN1          WAN2  DMZ2
 |     |             |     |
 |     |             |     |
 \___ PF1           PF2___/
       |             |
       |             |

Each pfSense router has its own separate WAN connection, and a separate DMZ network attached to it. They share a common TRUSTED LAN between them.

The machines on the trusted network have PF1 as their default gateway. PF1 has a static route defined to DMZ2 via PF2, and PF2 has a static route to DMZ1 via PF1. There is NAT to the WAN but internal networks (DMZ1/2 and TRUSTED) use different RFC1918 subnets.

I inherited this arrangement, and all used to work fine. I made a config change to PF1 (relating to multicast), and machines on DMZ2 suddenly could not talk to TRUSTED. I rolled the change back, but the problem persisted.

What I guess you'd hope would happen is that TCP packets would go DMZ2 -> PF2 -> TRUSTED and on return TRUSTED -> PF1 -> PF2 -> DMZ2. That's the only way I can see it would have worked. However, PF1 drops the returning packets. I've verified this using tcpdump.

I've worked around this by adding static routes to DMZ2 via PF2 to the servers on TRUSTED, but some devices on there do not support static routes so this is not ideal. Is there way to make this arrangement work decently, or is the design inherently flawed?


share|improve this question
Ideally, how do you want the network to operate, which hosts should be able to talk to what? Also 'PF1 has a static route defined to DMZ2 via PF1,' - presumably that should be via PF2? – James Yale Sep 6 '12 at 8:46
Thanks, fixed the typo. Ideally a machine on any of the 3 internal networks should be able to talk to any other on any of the other networks, firewall rules permitting. – JohnCC Sep 6 '12 at 9:10
Try System: Advanced: Firewall and NAT, and enable Static route filtering - does that allow the traffic? – James Yale Sep 6 '12 at 9:28
Good call! Useful to know that exists, but it's already set on both firewalls so it can't be that. – JohnCC Sep 6 '12 at 9:43
Is the packet dropped or blocked by the firewall? You should be able to see any blocks in the firewall log, Status: System Logs: Firewall – James Yale Sep 6 '12 at 9:47

You need the option to bypass filtering for static routes, under System>Advanced. Can't filter the traffic in that scenario since it's asymmetrically routed.

share|improve this answer
Hi Chris - that option is enabled on both firewalls. I do wonder if I've triggered an obscure pfSense bug somewhere since this used to work and then stopped when an apparently unrelated config change was made and then rolled back. – JohnCC Sep 7 '12 at 9:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.