Post #4263285

opnsense can do that. It's relatively well-featured and has not failed when I've used it. If you don't use the "Sticky Connection" option, clownflare will security-check you every other pageload. I was able to use that plus regular old pf rules to route specific subnets through desired WAN connections as well.