pfSense » pfSense Plus

Tested on 24.11

What I found that with Floating rules for ICMP with the interface set to "Any" if to run endless ping (ping 9.9.9.9) while WAN1 is a default gateway and then make WAN2 as a default gateway, ICMP traffic is switched to WAN2 interface BUT it's still using WAN1 as a Source IP. And Diagnostics/States table showed that ICMP traffic from host behind LAN is being NATted into WAN1 IP.

Any new initiated ICMP traffic uses WAN2 as a Source (while WAN2 is a default gateway).

So if to make WAN1 back as a default gateway, ping, which has been started initially, starts using WAN1 gateway. And ICMP ping which I run while WAN2 is a default gateway, starts being forwarded via WAN1 but with WAN2 as a Source IP.

Tested on latest 25.07-DEV (built on Wed Nov 27 18:22:00 UTC 2024)

I don't see this issue on 25.07-DEV: with Floating rules for ICMP with the interface set to "Any", ICMP traffic is forwarded via correct WAN gateway any time you switch from one WAN gateway to another and back.

Tested on 26.03.1 and on 26.11-DEVELOPMENT (built on Mon Jun 22 0:44:00 MSK 2026)

On both 26.03.1 and 26.11-DEVELOPMENT, I created a Floating Firewall rule with the following settings:

• Interface: Any
• 'Quick' checked
• 'direction: Out'
• Gateway: WAN1GW
  I then started a ping to 9.9.9.9 from an internal host and confirmed that the ICMP traffic was correctly forwarded through WAN1 while WAN1GW was the default gateway.

Next, I changed the default gateway to WAN2 under System → Routing. After that, I observed that the ICMP traffic continued to be forwarded through WAN1, but the packets were sent with the WAN2 IP address as the source. As a result, the ping failed.