RunBook AcademyOPNsense

← All checklists in OPNsense

Before deploymentHA readiness

Multi-WAN Readiness

15 items ·9 critical ·5 warn ·1 info

Multi-WAN on OPNsense is not just two WAN interfaces: it is a deliberate configuration of gateway groups, monitor IPs, sticky connections, and outbound NAT that together produce predictable failover and load balancing. If any of those pieces is wrong, traffic either flaps unnecessarily, breaks asymmetric flows, or fails to recover when a provider goes down.

When to use

Use this checklist when a single-WAN OPNsense firewall is being extended to a second provider, when failover or load-balancing behaviour is being redesigned, and after any change to a gateway or upstream provider. It also pairs with the HA / CARP readiness checklist on sites that combine multi-WAN with firewall HA.

How to use

Validate each item via the GUI and the shell. Capture a screenshot or exported config of the gateway groups and outbound NAT, perform a manual failover drill (disconnect one WAN, observe recovery), and file the result with the change system. Anything with severity critical must pass before production traffic flows over the second WAN.

Critical9 items

Both WAN interfaces are configured with the correct IPv4 and IPv6 settings (DHCP, static, or PPPoE as documented).
```
Interfaces > WAN; Interfaces > OPT_WAN2.
```
Gateways are configured for each WAN with monitoring IPs that are diverse and reachable across providers.
```
System > Gateways > Single; System > Gateways > Groups.
```
Each gateway has a sensible monitor IP (e.g. provider DNS, well-known anycast), not the gateway address itself.
Gateway groups define failover and/or load-balancing tiers with explicit priorities and triggers.
Sticky connections are enabled so a flow stays on the WAN it started on to avoid asymmetric routing.
```
Firewall > Settings > Advanced; "Allow default gateway switching" off unless intended.
```
Outbound NAT is configured to translate each internal subnet on each WAN gateway (Hybrid Outbound NAT recommended).
```
Firewall > NAT > Outbound; one translation per gateway.
```
DNS resolution works on both WANs; Unbound listens on both gateway addresses (or LAN, depending on design).
Inbound services (port forwards) are associated with a specific WAN, not exposed across both unless intended.
Failover behaviour is verified by manually failing each WAN and confirming recovery without operator intervention.

Warning5 items

Health-check thresholds are documented: packet loss / latency thresholds for failover are explicit, not implicit.
Per-host gateway overrides (where used) are documented and reviewed; no orphan overrides remain.
```
Firewall > Rules > LAN; Advanced > "Gateway" column.
```
Latency-sensitive traffic (e.g. VoIP) is pinned to a preferred WAN via gateway rules.
State table size accounts for the doubled flow count of two WANs.
```
sysctl net.inet.tcp.states; pfctl -ss | wc -l.
```
Provider ASNs are different and providers are diverse (broadband + cellular, dual broadband) per the DR plan.

Info1 item

A scheduled quarterly failover test is on the maintenance calendar.