I have a LAN with an ADSL modem/router on it. We have just gained an alternative high-speed internet connection at our location, and I want to connect the LAN to it, eventually dropping the ADSL.

I've chosen to use a small PFSense box to connect the LAN to the new WAN connection.

Two servers on the LAN run services accessible to the outside via NAT using the single ADSL WAN IP. We have DNS records which point to this IP. I want to do the same via the new connection, using the WAN IP there. That connection permits multiple IPs, so I have configured pfSense using virtual IP's, 1:1 NAT and appropriate firewall rules.

When I change the servers' default gateway settings to the pfSense box, I can access the services via the new WAN IPs without a problem. However, I can no longer access them via the old WAN IP. If I set the servers' default gateway back to the ADSL router, then the opposite is true - I can access the services via the ADSL IP, but not via the new one.

In the first case, I believe this is because an incoming SYN packet arrives at the ADSL WAN IP, and is NAT'd and sent to the internal IP of the server. The server responds with a SYN/ACK which it sends via its default gateway, the pfSense box. The pfSense box sees a SYN/ACK that it saw no SYN for and drops the packet.

Is there any sensible way around this? I would like the services to be accessible via both IPs for a short period at least, since once I change the DNS it will take a while before everyone picks up the new address.

  • You shouldn't set it up like that, do it as a multi-WAN setup as Frederik showed in his ASCII diagram, and everything will work fine. There are no clean ways to do it the way you're trying to do it. Sep 6, 2012 at 0:13

1 Answer 1


If you setup your whole setup something like this:

New WAN |  
         --> pfSense --> LAN
ADSL    |

so the pfSense gets 2 internet connections.

The above setup should work without too many problems, as the servers will now only have one gateway to use.

  • Will pfSense reply to TCP packets on the same gateway they arrive on? If not, I could see this still being a problem, since the NAT will not work with half a TCP connection and the remote will see TCP packets arriving back from a different IP.
    – JohnCC
    Sep 5, 2012 at 15:49
  • Uhm. That is actually a really good question. I don't have any pfSense boxes installed right now, so can't check for you
    – Frederik
    Sep 5, 2012 at 16:00
  • I'm assuming from Chris' comment that it will work so thanks for the answer!
    – JohnCC
    Sep 6, 2012 at 7:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .