# Routingproblem using 2 WAN's



## magicfingers (May 14, 2010)

Hi, I'm pulling my hair out because I cannot get my second ISP link to work.

This is the situation: I've a 8Mb DSL line connected to my FreeBSD 8 box primarily used for letting all of my users work remotely with Remote Desktop. Because I also want to let them browse the Internet (outside remote desktop, locally on their own laptop) my bandwidth was gone. I could have chosen for QoS but I thought it was better to install a second consumer Internetline.

So I did. I told Squid to use the alternate IP-address for outgoing request: 
	
	



```
tcp_outgoing_address 192.168.1.64
```
 (this is the address the modem gave me after DHCP).

In PF I enabled nat on the www_if:

```
nat on $www_if from $int_if:network -> ($www_if)
```

I told PF to use the correct gateway:

```
pass in on $int_if route-to { ($ext_if $ext_gw), ($www_if $www_gw) } from $int_if
pass in on $int_if route-to ($www_if $www_gw) proto tcp from $int_if to port http

pass out on $ext_if route-to ($www_if $www_gw) from $www_if to any
pass out on $www_if route-to ($ext_if $ext_gw) from $ext_if to any
```

But if I use wget to check if outgoing www-traffic is handled by de www_if it fails. I did it by using:

```
wget --bind-address 192.168.1.64 startpagina.nl
--2010-05-14 09:41:12--  http://startpagina.nl/
Resolving startpagina.nl... 62.69.184.140, 62.69.179.240
Connecting to startpagina.nl|62.69.184.140|:80...
```

No packets were blocked by PF. I think the problem might come from an error in my routing setup but I'm really lost.

Who can help me and what further info should I provide?

Best regards,

Janno Hordijk
MagicServices


----------



## magicfingers (May 17, 2010)

Hello, could anyone give me a hint to solve my problem? If you do need more info please let me know.

Best regards,

Janno Hordijk
MagicServices


----------



## DutchDaemon (May 17, 2010)

1. I don't understand how Squid figures in this setup. Is it transparent, are there rdr rules? Do users have to actively set a proxy?
2. It's usually a good thing to run [cmd=]pfctl -sn[/cmd] and [cmd=]pfctl -sr[/cmd] to see how the ruleset actually plays out.


----------

