Hello everyone. I’ve been reading through this subforum for several weeks now, trying to absorb as much as I can before jumping in with my own setup. I come from a background managing ERP systems and NetSuite implementations, where precise control over data flow and network dependencies is critical, so I appreciate detailed, step-by-step explanations.
I am currently planning a dual-WAN setup for a small manufacturing office using OPNsense. One connection is a business fiber line, and the other is a cable backup. My primary goal is to implement policy-based routing specifically to direct all Netflix traffic (and potentially other streaming services later) out the backup cable connection. The reason is to prevent streaming consumption from impacting the latency-sensitive traffic on the primary fiber line, which handles our inventory synchronization, VoIP, and B2B ecommerce platform communications.
I have a fairly good grasp of creating firewall rules and gateways from my work, but the application-based routing aspect is new territory for me on this platform. From my research, I understand it likely involves identifying Netflix's ASN or specific IP ranges and then creating a gateway group or firewall rule to direct that traffic. However, I have several detailed questions that I haven't seen fully addressed in the existing reviews and guides.
First, what is the most reliable method to obtain and maintain the list of Netflix IP ranges? I've seen mentions of using ASN 2906, but also suggestions that Netflix uses other ASNs and that their IPs can change. Is using a DNS-based approach with a resolver like Unbound more sustainable than a static alias list?
Second, concerning the gateway group configuration, should I set the backup WAN as the only member for this traffic with a tier of 1, or should I still include the primary with a higher tier for failover? My instinct is to not fail back to the primary for this traffic, to keep it segregated.
Finally, I am curious about the order of operations. If I create this rule, should it be placed high in the list, above or below the general LAN-to-WAN rules? I want to ensure it doesn't inadvertently catch or interfere with other secure traffic from our ERP reporting tools that also use cloud hosts.
Any insights, especially from those who have done this in a production-like environment for business purposes, would be greatly appreciated. I am particularly interested in any pitfalls you encountered with performance or rule management over time.