Gateway groups and tiers — Tier 1 primary, Tier 2 failover, Tier 3 load balance

A gateway group is a named collection of gateways with assigned tiers and a trigger level. The group is the unit the firewall rule references; the rule picks a group, not an individual gateway. Inside the group, the tier decides which gateway is preferred; the trigger level decides when the gateway is considered down. This lesson covers how tiers compose, how the trigger level interacts with the tier model, the three patterns (failover, load balancing, hybrid), and the discipline of wiring groups into firewall rules deliberately.

The tier model

A tier is a number from 1 to 5. Lower is more preferred. A gateway in tier 1 carries traffic while it is healthy; a gateway in tier 2 carries traffic only when every tier-1 gateway is unhealthy; tier 3 is reached when every tier-2 gateway is also unhealthy; and so on up to tier 5.

The tier model is preference, not exclusion. A gateway in tier 1 is preferred but not mandatory. The group uses the lowest-numbered tier that has at least one healthy gateway.

Five tiers is enough for the most exotic production deployments. Most estates use two tiers (primary and backup) or three (primary, secondary, last resort).

The trigger level

The trigger level is set per gateway group, not per gateway. The four options are the same as the gateway-level trigger:

The trigger level is the same for every gateway in the group. A group with three gateways all on tier 1, trigger Packet Loss, treats all three gateways identically: each is considered down when its loss exceeds the threshold. The failover decision is then “the lowest-numbered tier that has at least one healthy gateway” — and the load-balancing decision within a tier is “round-robin among the healthy gateways on the tier”.

The three patterns

Failover: Tier 1 + Tier 2

Two gateways, WAN-A on tier 1, WAN-B on tier 2. While WAN-A is healthy, all traffic uses WAN-A. When WAN-A is unhealthy, traffic moves to WAN-B. When WAN-A recovers, traffic returns.

The trigger level is the group’s choice. Most failover groups use Packet Loss or Packet Loss or High Latency, depending on the WAN character.

This is the right pattern for redundancy. The cost is half the bandwidth during normal operation.

Load balancing: Tier 1 + Tier 1

Two gateways, WAN-A and WAN-B, both on tier 1. The group round-robins flows between the two healthy tier-1 gateways. There is no tier 2 — when both are unhealthy, the group has no usable gateway and traffic fails.

This is the right pattern for capacity. The cost is per-flow, not per-packet distribution, and the sticky-connection considerations.

Hybrid: Tier 1 + Tier 1, Tier 2 + Tier 2

Four gateways. WAN-A and WAN-B on tier 1 (load-balanced). WAN-C and WAN-D on tier 2 (load-balanced). The group load-balances within tier 1; when every tier-1 is unhealthy, load-balances within tier 2.

This is the right pattern for capacity with redundancy. The cost is four WANs, four contracts, four monitoring configurations.

Wiring gateway groups into firewall rules

A gateway group is not a path on its own; it is a label that firewall rules reference. The configuration is the Gateway field on a firewall rule (under Advanced for the legacy rules page, or on the rule itself in the new Rules [new] page).

The rule picks the group; traffic matching the rule uses the group’s lowest-numbered healthy tier; return traffic uses reply-to to ensure symmetric routing. A rule that does not set the Gateway field uses the system default gateway.

The pattern for a segregation deployment:

Each rule has to be deliberate. A rule without a Gateway field uses the system default; the operator who forgets to set the Gateway on a rule they expected to route through the production group will be confused when the traffic uses the wrong WAN.

$ pfctl -s rules | grep -E 'pass|reply-to' | head -10

pass in quick on igb0 inet proto tcp from any to any port = 443 keep state (max-src-states 100) label "LAN to HTTPS"
pass in quick on igb0 inet proto tcp from any to any port = 443 keep state (max-src-states 100) label "LAN to HTTPS" rtable 1
pass in quick on igb0 inet proto tcp from 10.0.0.0/24 to any port = 53 keep state label "DNS to internal"
pass in quick on igb0 inet proto tcp from any to 10.0.0.50 port = 443 keep state label "HTTPS to internal server"

The five-tier hybrid in production

A five-tier configuration is the answer for a deployment with three classes of WAN:

• Tier 1 (load-balanced): Two fibre WANs from different ISPs. Healthy under normal load.
• Tier 2 (load-balanced): Two LTE/5G WANs from different carriers. Used when fibre is down.
• Tier 3 (single): A satellite or low-orbit link as the last resort.

The group composition: tier 1 has the two fibres, tier 2 has the two LTE links, tier 3 has the satellite. Trigger level Packet Loss or High Latency for every gateway. The group’s behaviour:

The cost is operational: every gateway needs monitoring, the tier assignment is deliberate, the failover trigger has to be tuned to each WAN’s character. The benefit is a multi-WAN deployment that handles any single WAN failure (and most double-WAN failures) without operator intervention.

Verifying the group’s behaviour

The diagnostic sequence for a gateway group:

1. System → Gateways → Configuration. Confirm every gateway in the group shows Online with realistic RTT and loss.
2. System → Gateways → Group. Confirm the group’s tier assignment and trigger level match intent.
3. Firewall → Rules. Confirm the rule that should use the group has the Gateway field set to the group name.
4. Live test. From a LAN host, run a download and tcpdump -ni igb1 host \<dst\> to confirm the egress interface matches the group’s tier-1.
5. Failover test. Pull the tier-1 WAN’s cable and confirm traffic moves to tier 2. Pull both and confirm traffic moves to tier 3. This is the test that proves the configuration works. The other checks verify the configuration is correct; this one verifies it behaves correctly under failure.

Summary

• Gateway groups are named collections of gateways with tiers and a trigger level. The group is the unit firewall rules reference.
• Tier 1 is preferred; tier 5 is last-resort. Five tiers are enough for any production deployment.
• The trigger level (Member Down, Packet Loss, High Latency, or both) is set per group and applies to every gateway in the group.
• Failover uses Tier 1 + Tier 2; load balancing uses Tier 1 + Tier 1 (and requires disabling shared forwarding); hybrid uses both.
• Wire gateway groups into firewall rules through the Gateway field. Every rule that should not use the system default has to set the Gateway explicitly.
• Verify with the GUI, the generated ruleset (pfctl -s rules | grep rtable), and a live failover test.