Gateways, default routes and asymmetric routing · OPNsense

A firewall is also a router. It has routes for everything it knows about (directly connected networks, static routes, dynamic routes, the default route) and uses those routes to decide which interface a packet leaves on.

If the route the firewall picks for the forward direction and the route the rest of the network picks for the return direction do not agree, you have asymmetric routing. Stateful firewalls fall over when this happens.

How a host picks a route

A host’s routing table looks like this:

Destination        Gateway          Interface
127.0.0.0/8        link-local       lo0
192.0.2.0/24       link-local       eth0        ← directly connected
0.0.0.0/0          192.0.2.1        eth0        ← default route

To send a packet to 203.0.113.50, the host walks the table:

Is there a route for 203.0.113.50 exactly? No.
Is there a route for 203.0.113.0/24? No.
Is there a route for 203.0.0.0/16? No.
Is there a default route (0.0.0.0/0)? Yes → 192.0.2.1.

The longest matching prefix wins. That is the “longest prefix match” rule. /0 is the shortest possible match — anything matches it — so it is the fallback.

Read-only / Safenetstat -rn— FreeBSD's netstat -rn prints the routing table. U means up, G means gateway route (off-link), S means static, H means host. The 'default' route is the route that catches every destination not otherwise matched; here it sends everything not local to 192.0.2.1 (the firewall's LAN IP).

$ netstat -rn

Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use   Netif Expire
default            192.0.2.1          UGS         0        0     em0
127.0.0.1          link#4             UH          0        0     lo0
192.0.2.0/24       link#1             U           0        0     em0
192.0.2.50         link#1             UHS         0        0     lo0

Illustrative output

How OPNsense picks a route

OPNsense’s routing table is the same shape, with one entry per directly-connected interface plus any static or dynamic routes the operator added. The routing page (System → Routes → Configuration) shows the table; System → Routes → Diagnostics and the CLI netstat -rn show the same data.

The decisions the firewall makes:

Destination matches	Action
Directly connected network	Send directly via that interface’s ARP/ND
Static or dynamic route	Forward to that route’s gateway
Nothing else matches	Forward via the default route (the “WAN gateway”)
Nothing matches and no default	Drop

The “gateway” field in the static route is the IP of the next-hop router. The firewall ARPs that IP and sends the packet to its MAC.

Symmetric and asymmetric routing

Symmetric routing means the forward path and the return path for a flow are the same set of routers, in the same order, in reverse. For a flow from LAN to WAN:

LAN host → OPNsense → WAN router → Internet → Server
Server → Internet → WAN router → OPNsense → LAN host

Every router on the forward path sees the corresponding return packet. PF can match state.

Asymmetric routing is when one direction takes a different path:

LAN host → OPNsense → WAN-A → Internet → Server
Server → Internet → WAN-B → OPNsense → LAN host

The outbound path went via WAN-A; the return path came back via WAN-B. OPNsense will see the return packet on its WAN-B interface but have no state for it (the state is on WAN-A). The packet will be dropped.

Causes of asymmetric routing

Multi-WAN misconfiguration. Two WAN interfaces each have a default route; outbound traffic uses one, inbound traffic from the other provider returns via that other provider. The firewall’s state for the connection is on the first WAN, but the return packet arrives on the second.
Server-side routing. A server has two interfaces, the application binds to one but the OS routes outbound responses via the other.
ECMP / link aggregation. Equal-cost multi-path routing on upstream routers can pick different paths for each direction.
Direct connections between subnets. If two OPNsense interfaces are bridged to the same broadcast domain and the hosts also have a default route, traffic may take the host’s default instead of the firewall’s route.

Diagnosing asymmetric routing

The tool is traceroute (or tracert on Windows). Run it in both directions for a problematic flow:

Read-only / Safetraceroute— Run traceroute from a LAN host to the server, and from the server back to the LAN host. If the paths diverge at any hop, you have asymmetric routing. The fix is to make the upstream routers agree on a single return path — typically by configuring source-based routing on the upstream or by using policy routing on the firewall.

$ traceroute -n 203.0.113.50

traceroute to 203.0.113.50 (203.0.113.50), 64 hops max
1  192.0.2.1      0.412 ms      ← firewall (LAN)
2  198.51.100.1   4.220 ms      ← WAN-A gateway
3  10.0.0.1       8.113 ms      ← ISP-A
4  ...
10  203.0.113.50   32.890 ms

Illustrative output

If the two paths diverge, the fix is not on OPNsense; it is on the upstream network that has multiple equal-cost paths. OPNsense cannot force a remote router to send return traffic via a specific path.

The cases OPNsense can fix are:

Multi-WAN with both interfaces accepting default routes. Use gateway groups and the firewall’s outbound NAT rules to keep return traffic on the same WAN it left on.
Server-side routing where the firewall can rewrite the source IP (NAT) so the server sees the traffic as coming from the firewall and replies to the firewall.

Summary

Routing is “longest prefix match, fallback to default”.
Symmetric routing keeps stateful filtering working. Asymmetric routing breaks it in a way that looks intermittent.
The first tool for diagnosing asymmetric routing is traceroute in both directions.
OPNsense can fix some asymmetric-routing cases via policy routing and NAT; others require upstream cooperation.