Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am seeing some strange behavior in pfSense 2.0.3 in which all of my WAN interfaces are up according to the Interfaces screen, yet all but the default gateway are shown as "Offline" in gateway groups.

My default gateway works just fine.

My first thought was that the gateways do not respond to ICMP, but I am able to ping them from an unrelated connection (ie from outside) just fine.

Even stranger, using the "Ping" tool in WebConfigurator I can ping from all of the WAN interfaces, yet they cannot ping their own next hop.

Strangest of all, when I use an alternative monitor IP of for any of the interfaces, it stops being pingable!

I am wondering the following:

  • Does the Ping tool in WebConfigurator still have the firewall and outbound NAT rules for localhost applied to it?
  • Has anybody seen anything like this before?
share|improve this question
I kind of hate pfSense for hiding that you can't have multiple gateways as you think you've configured. It takes your configuration and translates it to firewall rules (I understand how that sounds like the same thing, but firewall filtering and routing are completely separate subsystems). Regardless, I'm glad it's working. – Chris S Mar 20 '13 at 4:13
@ChrisS, meaning is all traffic still just going to the default gateway, and then the floating firewall rule is applied there to forward along to another interface? ... and can you think of any reason why I was able to ping despite the fact that the rule was being applied? – tacos_tacos_tacos Mar 20 '13 at 4:26
The firewall "messes" with packets as they flow through. If something is scheduled to go out on WAN2, the firewall writes in the appropriate source address and switches the "network view" (the new view has a different default gateway, even though the base system still has the original gateway). The routing subsystem obeys this alternate network view and things proceed as you might expect. – Chris S Mar 20 '13 at 5:20
As for working, I'm pretty sure whatever utility was being called bound to the IP of the WAN interface, but did not open a raw socket on that interface. The OS would automatically use the wan IP of the interface with the default gateway when sending traffic externally. Which would make it look like is working. – Chris S Mar 20 '13 at 5:21
The "network view" thing makes a lot more sense to me heuristically - thanks for the info. – tacos_tacos_tacos Mar 20 '13 at 5:49
up vote 0 down vote accepted

So, I've learned something new: when you Ping from WebConfigurator, firewall rules are still applied.

In my case, I had a stupid floating rule that was assigning a gateway group of WANS A,B,C,D to ANY protocol, ANY source, ANY destination, OUT.

As a result, pings on gateways B, C, D were obviously going to time out, since ICMP traffic was being always routed through A.

After fixing the rule to only apply to TCP/UDP traffic, the problem was completely resolved.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.