pfSense

It should be more clear from the attached picture.

The network 1.1.1.0/26 should be reachable from the Internet and both routers (10.0.0.6 and 10.0.0.13) should work in a failover mode.

There is no problem with incoming connection to 1.1.1.0/26 network. I have created the Gateway Groups (10.0.0.6 and 10.0.0.13) and the firewall rule on the uplink interface matching with packets with the destination in 1.1.1.0/26 with the gateway option set on this Gateway group. It's work as expected.

But, if some host in the 1.1.1.0/26 network initializes connection to the Internet, the reply packets are not routed to the live member of the Gateway Groups. After some research I've came up with the solution. I have created the firewall rule on the internal interface matching with packets with the source in 1.1.1.0/26 network and destination in the Internet with the reply-to option set on one of the gateway.

It's work. Unfortunately this cannot be set in the PfSense GUI and I lost the Failover functionality provided by Gateway Groups.

From what I can tell, the referenced scenarios would be solved by adding a gateway to the interface. This is the currently supported way of using reply-to. When an exception is needed on interfaces with gateways, an option is available per rule to disable reply-to. If there's a scenario that is not covered by this, the feature can be reconsidered.

There are some scenarios where it would be nice to have the ability to force reply-to to use a specific value and not be automatic. For example, cases with multiple gateways on the same interface, or certain VPNs that may not have the exact expected behavior with the automatic settings.