Skip automatic static routes for gateway monitoring/dpinger

[haarp]

Important notices

• [x] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [x] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

When a monitor IP is entered for a gateway, Pf/Opnsense will automatically create a static route for this IP and prevent the IP from being reused in other gateways. This behavior is unexpected and can lead lot of time spent debugging, or even broken DNS (in a multi WAN setup when the monitor IP is also the DNS server)

It is also not well documented or obvious when working on the web interface.

Examples:

• https://www.reddit.com/r/PFSENSE/comments/9nit40/unbound_uses_failover_wan_despite_being/
• https://www.reddit.com/r/PFSENSE/comments/rcmho8/changing_the_monitor_ip_of_a_gateway_caused_all/
• https://forum.netgate.com/topic/144488/gateway-monitor-ips-are-being-put-into-the-routing-table/18
• https://forum.netgate.com/topic/127191/setting-host-as-monitored-ip-makes-it-unreachable

Describe the solution you like

The current implementation seems dependent on this behavior. However, pfsense has recently received a PR that changes this: https://github.com/pfsense/pfsense/pull/4551

I would like to kindly request the same for Opnsense.

Describe alternatives you considered

In case this feature request is rejected, please at least add a warning to the web interface where monitor IPs are configured, indicating that it will lead to an automatic static route being created.

Thanks a lot!

[AdSchellevis]

It's one of the things we indeed inherited from the past and is difficult to remove as standard behaviour, since a lot of people depend on it. Making this more explicit and offering the option per gateway to disable the route is probably the clearest option as you do need to go to that screen to enable the monitor in the first place.

Relevant backend code:

https://github.com/opnsense/core/blob/840c465d2bbd943acd4d0f0967ff284a8f83a6f6/src/etc/inc/plugins.inc.d/dpinger.inc#L172-L191

https://github.com/opnsense/core/blob/840c465d2bbd943acd4d0f0967ff284a8f83a6f6/src/etc/inc/plugins.inc.d/dpinger.inc#L233-L253

[fichtner]

It’s more or less the scope of https://github.com/opnsense/core/issues/5989 already

[fichtner]

We need to create more visibility first before adding more overrides.

[AdSchellevis]

@fichtner sure, I don't mind having the routes cleaned up first and adding toggles where needed later. In this case I think it makes sense to add a toggle in the gateway edit so it's at least explicit from a user perspective in the correct spot. No need to rush this in.