Support Multiple FIBs in pfSense
The current default pfSense kernel is not built with multiple FIB support. Multiple FIB support has been in FreeBSD since Freebsd 6.0 or earlier.
#4 Updated by Jeremy Porter almost 4 years ago
As of 2.3 at least sysctl net.fibs report 4 fibs defined, and setfib is included in the distribution.
[2.3-BETA][email@example.com]/root: sysctl -a | grep fib
[2.3-BETA][firstname.lastname@example.org]/root: setfib 1 sysctl -a | grep fib
#6 Updated by Stéphane Lapie about 2 years ago
I just stumbled upon a case where it would be nice to have the webConfigurator in a separate FIB, because of routing troubles.I have a scenario where I have pfSense on these networks :
- LAN1 (legacy network for which I need to provide net access via WAN and NAT)
- LAN2 (on which I want to have SNMP, management screen)
- MGMT -> GW1 -> LAN1 -> pfSense
- MGMT -> GW1 -> LAN1 -> GW2 -> LAN2 -> pfSense
- Have pfSense route to MGMT via GW2, for easy access to the management screen
- Have LAN1 equipments route by default via pfSense, but to MGMT via GW1
Unfortunately LAN1 has a lot of legacy equipment for which it is not possible to set static routes. The problem is that then, we end up with assymetrical routing (LAN1 -> pfSense -> LAN2 -> GW2 -> MGMT), and GW2 ends up botching the state handling, which results in frequent broken pipes.I would therefore like to :
- Have standard routing for MGMT network done via GW1 in fib 0
- Have webConfigurator and SSH run in fib 1, which would route via GW2 for MGMT network
I tried receiving packets on LAN2 for SSH/HTTP/HTTPS (after disabling the lockout rule), and setting a route-to GW2 directive, but it seems this fails, even when setting sloppy states.