Support Multiple FIBs in pfSense
The current default pfSense kernel is not built with multiple FIB support. Multiple FIB support has been in FreeBSD since Freebsd 6.0 or earlier.
Updated by Jeremy Porter about 6 years ago
As of 2.3 at least sysctl net.fibs report 4 fibs defined, and setfib is included in the distribution.
[2.3-BETA][firstname.lastname@example.org]/root: sysctl -a | grep fib
[2.3-BETA][email@example.com]/root: setfib 1 sysctl -a | grep fib
Updated by Stéphane Lapie over 4 years ago
I just stumbled upon a case where it would be nice to have the webConfigurator in a separate FIB, because of routing troubles.I have a scenario where I have pfSense on these networks :
- LAN1 (legacy network for which I need to provide net access via WAN and NAT)
- LAN2 (on which I want to have SNMP, management screen)
- MGMT -> GW1 -> LAN1 -> pfSense
- MGMT -> GW1 -> LAN1 -> GW2 -> LAN2 -> pfSense
- Have pfSense route to MGMT via GW2, for easy access to the management screen
- Have LAN1 equipments route by default via pfSense, but to MGMT via GW1
Unfortunately LAN1 has a lot of legacy equipment for which it is not possible to set static routes. The problem is that then, we end up with assymetrical routing (LAN1 -> pfSense -> LAN2 -> GW2 -> MGMT), and GW2 ends up botching the state handling, which results in frequent broken pipes.I would therefore like to :
- Have standard routing for MGMT network done via GW1 in fib 0
- Have webConfigurator and SSH run in fib 1, which would route via GW2 for MGMT network
I tried receiving packets on LAN2 for SSH/HTTP/HTTPS (after disabling the lockout rule), and setting a route-to GW2 directive, but it seems this fails, even when setting sloppy states.