Gateway monitoring & multi-WAN

Health-probe each WAN gateway and fail over (or load-balance) traffic across a group of uplinks. BGP →

{{#DRIFT_BADGE}}{{#B_UNSAVED}}Unsaved edits{{/B_UNSAVED}}{{#B_OK}}In sync{{/B_OK}}{{/DRIFT_BADGE}}

Confirm gateway change

A live gateway change by {{PENDING_ACTOR}} is awaiting confirmation and reverts automatically in {{PENDING_REMAINING}} seconds unless you keep it. If the change broke your connectivity, simply do nothing — the previous gateway configuration restores itself.

Automatic revert failed — the gateway configuration may be in an inconsistent state. The change keeps retrying in the background; if it persists, resolve it from the console.

Groups {{GROUPS_LABEL}} Monitors {{MONITORS_LABEL}} Liveness {{LIVENESS_LABEL}}

⚠ A group has all members down — the last-known member is being held installed so the box is never left without a default route. It recovers automatically the moment any member's loss clears.

⚠ A monitored group steers your management path — failover will re-home this admin session like any other traffic (state table flushed). Confirm the management acknowledgement below before applying.

⚠ Multi-WAN groups steer forwarded traffic, but IPv4 forwarding is off — this box will not forward transit traffic between its WANs and LANs. Enable it under Setup → Network tuning.

Gateway groups

A group is an ordered set of uplink members. The lowest tier wins; members sharing a tier load-balance by weight. When a member's gateway is monitored DOWN it is withdrawn from the live pool and traffic re-homes onto a survivor. Flush states on failover kills the PF state table pinned to the dead egress so live connections move immediately instead of black-holing until timeout.

Monitors

One monitor per gateway. Each probes a set of anchor IPs (a minimum of two, seeded with 1.1.1.1 / 8.8.8.8 / 9.9.9.9) every interval seconds. Loss is judged as the mean over a rolling window of period × window buckets, so one bad minute ages out. The gateway stays UP while at least min-up anchors are reachable; it is capped at anchors−1 so a failover always needs sustained loss on at least two anchors — a router-connectivity signal, never a single remote-IP blip.

Per-WAN status

Live member state from the gateway liveness probe — Up / Down / Warming, anchors m/n up with the worst per-anchor loss, latency, and which member is currently carrying the group's default. Refreshed every few seconds while this tab is open. Read-only telemetry.

Live status requires JavaScript.

Read-only gateways.yaml rendered from the saved configuration (re-rendered after each save; unsaved edits are not reflected).

{{GW_RENDERED_PREVIEW}}

Preview truncated for display — validation and drift always use the full render.

No gateway configuration to preview yet — add a group with members and save to render gateways.yaml.

{{#WRITE}} HA-aware (CARP pairs) — while any CARP state on this node is BACKUP, suppress the PF state-table flush on gateway failover (pfsync replicates the master's states here; a backup flush would destroy them). Probing, pool re-renders and the box default keep working. Enable on BOTH peers running 9.R2.d or newer. {{/WRITE}} {{#MGMT_CONFIRM}} This change steers your management path — I understand that a group whose route-to pool carries the default-route interface will re-home this admin session on failover (and a full PF state flush drops every state, including mine). The commit-confirmed window below auto-reverts if a bad apply severs my access. Acknowledge to apply. {{/MGMT_CONFIRM}} {{#WRITE}} {{#CONFIRM_WINDOW}} Arm a commit-confirmed window on apply — the new gateway configuration goes live but reverts itself unless you confirm within seconds. Recommended whenever a group steers the management path. {{/CONFIRM_WINDOW}} {{/WRITE}}