Bug #10546


Gateways removed from routing groups based on low alert thresholds

Added by Vladimir Voskoboynikov over 1 year ago. Updated about 1 year ago.

Target version:
Start date:
Due date:
% Done:


Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
Affected Architecture:


In a Multi-WAN failover scenario, individual gateways are added and removed from gateway groups based on dpinger alarms, which trigger when the 'high' latency or packet loss thresholds are crossed. Gateways are added/removed from gateway groups in get_gwgroup_members_inner(), and the gateway status is reported from return_gateways_status() without a detailed status. Thus, the gateway status can be one of "down" (high latency or loss threshold exceeded), "loss" (low loss threshold exceeded), "delay" (low delay threshold exceeded), or "none" (below all thresholds).

get_gwgroup_members_inner() will also remove gateways for the "loss" and "delay" states, which is unexpected. This leaves the following potential scenario:

  1. A gateway exceeds the high latency (or loss) threshold. A dpinger alarm is raised, and the gateway is removed from the gateway group.
  2. The gateway returns to a latency between the low and high thresholds. A dpinger alarm is raised, but the gateway is not added back to the gateway group as it is still in a "loss" status.
  3. The gateway returns below the low loss threshold, and remains that way. No dpinger alarm is raised, as the high threshold was not crossed, and no code is ever called to reconsider the gateway groups. The gateway remains removed from the gateway group indefinitely.

In this case, pfsense will consider a gateway down when it has actually returned to a normal state, necessitating administrator action to return it back to a proper state.

Actions #1

Updated by Jim Pingle over 1 year ago

  • Target version set to 2.5.0
Actions #2

Updated by Jim Pingle over 1 year ago

  • Status changed from New to Pull Request Review
Actions #3

Updated by Renato Botelho over 1 year ago

  • Assignee set to Renato Botelho
Actions #4

Updated by Jörn Greszki over 1 year ago

Dear gents

is the behavior I describe

related to your findings?

Actions #5

Updated by Renato Botelho over 1 year ago

  • Status changed from Pull Request Review to Feedback

PR has been merged. Thanks!

Actions #6

Updated by Vladimir Voskoboynikov over 1 year ago

  • % Done changed from 0 to 100
Actions #7

Updated by Steve Beaver over 1 year ago

  • Status changed from Feedback to Resolved
Actions #8

Updated by Jörn Greszki about 1 year ago

Now tested with 2.5.0.a.20201101.1850

I still get for unknown reasons sometimes partial or full loss for alive-ping at one of the 2 WAN interfaces, but this is not the issue.

Nov 2 10:37:56 dpinger 16236 WAN_PHY1_IGB0GW Alarm latency 0us stddev 0us loss 100%

Problem is that this status remains until any change to the gateway group is made - then it works immediately.

dpinger is not reattempting to reach the defined IP or the process maintaining the operational status is not taking over the changes.


Also available in: Atom PDF