Skip to main content
RunBook Academy

← All break/fix scenarios in OPNsense

advancedNetworking~35 min

Break/Fix: Multi-WAN failover does not occur when one WAN goes down

Reported symptoms

  • ●One WAN link is down (physical or upstream)
  • ●The gateway monitor shows the failed WAN as down (apinger reports loss)
  • ●The firewall does NOT fail over to the other WAN
  • ●Hosts on the LAN cannot reach the Internet

Evidence

  • · apinger output shows 100% packet loss to the failed gateway monitor IP
  • · pfctl -s state shows traffic still on the failed WAN interface
  • · Gateway group status shows the failed gateway as down
  • · Firewall logs do not show any failover-related events
Diagnosis and resolutionclick to reveal

Root cause

The firewall rules on the LAN interface do not reference the gateway group. Without the gateway group reference, the firewall uses the default gateway (which may be the down WAN) for all outbound traffic. The gateway group is only consulted by rules that explicitly reference it.

Remediation

Edit the LAN interface rules (and any other rules that should use multi-WAN) to reference the gateway group as the gateway. Apply the change. Validate that traffic now flows over the healthy WAN. Audit any other rules that may need the same fix.

Verification

When the failed WAN is unplugged, traffic flows over the healthy WAN. apinger reports the down gateway correctly. The gateway group policy applies.

Prevention

When configuring multi-WAN, audit every firewall rule that should use the gateway group. Document the gateway group reference as part of the rule description. Review the audit quarterly.

Scenario

You operate an OPNsense firewall with two WAN links. ISP-A goes down (upstream confirmed). Users on the LAN report they cannot reach the Internet. The OPNsense GUI shows ISP-A’s gateway as down in the gateway group, but traffic is still being sent out the ISP-A interface.

Available evidence:

  • ISP-A physical link is down (cable unplugged or upstream router down).
  • apinger output: 100% loss to ISP-A’s gateway monitor IP.
  • pfctl -s state: states are still being created on the WAN-A interface.
  • Gateway group status: ISP-A gateway marked down, ISP-B gateway up.
  • The gateway group policy should be: traffic goes to ISP-B when ISP-A is down.
Break/Fixadvanced35 minnetwork

Multi-WAN failover does not occur

Symptoms

  • One WAN link is down (physical or upstream)
  • Gateway monitor reports the failed WAN as down
  • Firewall does NOT fail over to the other WAN
  • LAN hosts cannot reach the Internet

Available evidence

  • apinger output: 100% packet loss to the failed gateway monitor IP
  • pfctl -s state: traffic still on the failed WAN interface
  • Gateway group status: failed gateway is down
  • No failover-related events in firewall logs
Show diagnosis & remediation

Root cause

The firewall rules on the LAN interface (and any other interface that should use multi-WAN) do not reference the gateway group. Without the gateway group reference, the firewall uses the default gateway, which is the failed WAN.

Safe remediation

Edit the rules to reference the gateway group as the gateway. Apply. Validate. Audit other rules.

Verification

When the failed WAN is unplugged, traffic flows over the healthy WAN. The gateway group policy applies.

Prevention

Audit every rule that should use the gateway group. Document the reference in the rule description. Quarterly review.