What is Policy-based Routing?
In networking, network traffic is usually managed by the system's routing table; This routing table can either be static, or dynamic based on your network topology. Policy-Based Routing (PBR) is a technique used to make routing decisions based on policies set by you.
The traditional Policy Based Routing is based on the IP layer, and also the services the network is running. Firewalla Policy Based Routing is much more flexible, and also can be mapped to the destination category (gaming, video).
- Firewalla PBR is content-aware
- The PBR feature will only work if you have multiple WAN or VPN connection
- The full PBR feature is available on the Firewalla Gold and Firewalla Purple
- Routing to VPN is supported for the Blue Plus
- You can specify any type of traffic and route them to your VPN servers, as long as the VPN is connected.
- If you have a dual-WAN setup, you can route any traffic to any WAN connection no matter the WANs are set to failover or load balancing.
- Routing all video traffic to a 3rd party VPN server
- Routing all traffic on PC to the standby WAN
- Running Zoom or Gaming from a low latency WAN interface
How to use it?
On Firewalla Box main page, tap Routes -> Add Route, specify any type of traffic, matching a device/group/network, and route it to any VPN connection or WAN connection.
The following Targets are supported in Routes:
- Target List (Beta)
- IP Address
- IP Address Range
- Remote Port
- All Gaming Sites
- All Social Sites
- All Video Sites
When there is conflict, the more specific the target and device scope are, the higher priority it is.
The priority list for device scope is Device > Group > Network > Global(All devices).
- When there is conflict, device/group rules will take precedence over Network rules.
- When there is conflict, Network rules will take precedence over Global rules.
For targets, the priority list is IP/Port > CIDR > Domain > Target List/Category > Region > Internet.
Network Flows Shortcut:
Network Flows are a history of all inbound and outbound network traffic on your network. If you need to send certain type/s of flows to another WAN or VPN, on any flows, when you tap on the "route" button, a Route rule can be created based on the destination/source and the device/group/network or all the flow devices.
Route all video traffic on your iPad to an ExpressVPN server,
- Box main page -> Add Route
- Set a target -> All Video Sites
- Select a device -> iPad
- Select an interface -> VPN -> ExpressVPN
(VPN connection should have been set up in the VPN Client feature)
With this route, all the traffic to video sites will be routed to ExpressVPN when the VPN is connected.