How to Configure Dual WAN on pfSense with Failover and Load Balancing

Why your business needs multiple internet links

Every modern corporate operation relies on continuous and stable internet connectivity. When a company's single internet link drops, the financial impact is usually immediate, paralyzing customer service systems, sales platforms, and internal communications. To mitigate this risk, implementing a Dual WAN architecture—connecting two or more internet service providers to a single edge router—has become standard practice in environments requiring high availability. Before diving into practical configuration, it helps to understand that this redundancy is akin to having two different routes to work: if the primary road is congested or closed, traffic automatically detours through the secondary path.

Within the open-source networking ecosystem, pfSense stands out as one of the most robust platforms for managing this complexity without high licensing costs. It enables not only failover (where the system switches to the backup connection only when the primary fails) but also load balancing (intelligent traffic sharing among available links). To better evaluate your connection's baseline health before touching the edge, it is worth reviewing the guide on how to diagnose packet loss using mtr to isolate specific ISP issues. The secret to a successful transition lies in creating logical gateways and continuously monitoring latency and packet drop rates on each interface.

Configuring multiple gateways and packet monitoring

The first practical step in the pfSense administrative dashboard is ensuring that both internet connections (such as a primary fiber link and a backup cable or radio link) are physically plugged into the network cards designated as WAN1 and WAN2. Each interface will acquire an IP address via DHCP, static assignment, or PPPoE. The critical element here is the gateway monitoring setup, which instructs the firewall to send ICMP echo request probe packets to a reliable public IP address, such as Google's or Cloudflare's public DNS, actively measuring the physical and logical integrity of that specific data channel.

When pfSense detects a significant surge in packet loss or unacceptable latency on an interface, it flags that gateway as degraded or down. This constant verification prevents the 'black hole' phenomenon, where an ISP loses internet access while keeping the physical link status active, tricking standard routers. For complex environments, combining WAN redundancy with internal switch aggregation using the guide on how to configure LACP link aggregation on network switches ensures the network bottleneck is never inside the corporate LAN. Tuning latency and packet loss thresholds prevents false positives during minor carrier fluctuations.

Creating load balancing and failover gateway groups

Once gateways are properly configured and monitored, the next step is combining them into a 'Gateway Group'. This section defines the distribution strategy. We can create a group strictly for failover by placing the primary link in 'Tier 1' and the backup link in 'Tier 2', instructing the system to activate the secondary link only if the primary completely fails or hits the critical packet loss threshold. If load balancing is preferred, both gateways are assigned to the same Tier, allowing traffic to be distributed based on weights proportional to each link's bandwidth capacity.

In practice, this means that if you have a 300 Mbps link and a 100 Mbps link, you can adjust weights so the primary receives three times more simultaneous connections than the backup. This intelligent distribution prevents the smaller connection from saturating while the larger one sits idle. However, state-based load balancing can occasionally cause issues with banking systems or platforms requiring a consistent source IP throughout a session. To handle this, pfSense maintains state tables (sticky connections) that pin a user's traffic to the same gateway during active sessions, balancing overall load without breaking applications sensitive to sudden IP changes.

Applying specific route-based firewall rules

The true power of pfSense shines when we apply granular rules under 'Firewall: Rules', specifically on the LAN interface. By default, internal network traffic will use the default gateway group we defined. However, enterprise scenarios demand strategic exceptions. For instance, we can create a rule directing all CCTV or VoIP server traffic to exit exclusively through the most stable fiber link, while administrative workstations utilize the load balancing group. To ensure these custom routing policies aren't bypassed by local DNS failures, verify that primary and secondary DNS servers point to external IPs reachable via both links.

Another essential precaution when deploying policy-based routing is validating traffic behavior when a link goes down. If a rule forces traffic to exit exclusively through WAN1 and WAN1 fails, that user's connection will drop unless automatic fallback options are enabled in the advanced firewall rule settings. For administrators auditing network performance after rule deployment, auxiliary stress-testing tools help map behavior under load, complementing native monitoring. Thorough documentation of every change ensures any support team can quickly revert or adjust edge behavior during unexpected maintenance windows. To explore these architectural concepts further in production, see our related technical analysis on How to test transformer thermal fuses with a multimeter.

Validation, stress testing, and final thoughts

With the entire Dual WAN topology configured, the most critical phase is validation in a controlled environment. Before releasing the system to production for the entire organization, simulate physical failures by unplugging the network cable from the primary WAN. Observe the pfSense reaction time, the behavior of the gateway monitoring dashboard, and whether active user sessions seamlessly migrate to the backup link. Also monitor the automatic return of traffic to the primary link as soon as primary connectivity is restored, preventing the business from needlessly consuming expensive or capped backup bandwidth.

Successfully implementing redundancy and load balancing in pfSense transforms a vulnerable infrastructure into a resilient corporate environment prepared for unexpected outages. The secret lies in patience during the fine-tuning of monitoring parameters and the clarity of applied routing rules. By mastering these concepts, you ensure that ISP outages shift from operational crises to transparent events for business routines. Keep firmwares updated, back up configurations regularly, and document your network architecture to guarantee long-term longevity and ease of maintenance.