Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense HA LAN Interfaces Only

    Scheduled Pinned Locked Moved
    HA/CARP/VIPs
    2
    91
    16.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      viragomann @CloudNode
      last edited by

      @iptvcld said in pfSense HA LAN Interfaces Only:

      I will give this a shot today. So when I swing the wan over from primary to secondary node as a failover, this will restore internet to flow over the backup only?

      Yes, the gateway group cares that the the secondary use primarys LAN only if the WAN DHCP isn't available.

      It's only to provide internet to the secondary and doesn't affect any other connections.

      I guess, it's a good idea to set a public IP for monitoring (e.g. 8.8.8.8) in the LAN gateway settings. This way the secondary detects the gateway as offline in case you activate the CARP maintenance mode on the master and will switch over to the WAN gw.

      C 1 Reply Last reply Reply Quote 0
      • C
        CloudNode @viragomann
        last edited by

        @viragomann
        I guess, it's a good idea to set a public IP for monitoring (e.g. 8.8.8.8) in the LAN gateway settings. = would I do this on the primary node or secondary node?

        This way the secondary detects the gateway as offline in case you activate the CARP maintenance mode on the master and will switch over to the WAN gw. = if I enable carp mant mode on the master node and I don't swing the wan fiber over to secondary node, it would simply mean no internet until that connection is made? What would happen if don't don't enable carp maint mode on master and just swing over wan to secondary? I guess my carp for Lan will still be master on my primary as Lan is still up.

        I'm sorry I am just trying to get a full picture and you have been really great help.

        V 1 Reply Last reply Reply Quote 0
        • V
          viragomann @CloudNode
          last edited by

          @iptvcld said in pfSense HA LAN Interfaces Only:

          I guess, it's a good idea to set a public IP for monitoring (e.g. 8.8.8.8) in the LAN gateway settings. = would I do this on the primary node or secondary node?

          On the secondary. This gateway should only exist on the secondary at all.

          f I enable carp mant mode on the master node and I don't swing the wan fiber over to secondary node, it would simply mean no internet until that connection is made?

          Of course you have to connect the WAN cable to the secondary manually in this case to get internet.

          What would happen if don't don't enable carp maint mode on master and just swing over wan to secondary?

          Nothing. Failover only happens when a CARP interface failing is detected on the primary.
          Pulling the WAN cable from the master and connect to the secondary will simple result in loosing internet. The primary will keep staying in master mode.

          C 1 Reply Last reply Reply Quote 0
          • C
            CloudNode @viragomann
            last edited by CloudNode

            @viragomann I hope I did this correctly - I also have a OpenVPN address in the group and not sure what Tier to assign to that. I leave it default Never (not sure if that should be something else as it left it out when i pressed save)
            55b9f6e8-4df9-4f3f-b0e4-ebc4fc70e5b8-image.png
            83cb5fe5-4a3f-4888-8b39-d307183ad9ba-image.png

            20ba1844-e88a-47d2-97f1-6167edf7eb90-image.png

            7e75cb6c-012b-4689-961a-a21f72631f51-image.png

            1 Reply Last reply Reply Quote 0
            • C
              CloudNode
              last edited by

              Master pf LAN Interface IP: 192.168.2.80
              Backup pf LAN Interface IP: 192.168.2.81
              LAN CARP = 192.168.2.1

              06a5f5ed-a9b8-485c-bf09-49621d2ff9a9-image.png

              Cant get the internet to flow to backup

              1 Reply Last reply Reply Quote 0
              • C
                CloudNode @viragomann
                last edited by

                @viragomann hmm. Can't seem to get to working. I have turned off HA static route sync from the master node and then on the backup node I have created a new gateway using LAN pointing to the LAN interface IP of the master node and then created a Gw Group with pppoe wan as tier 1 and my new gw as tier 2 and set this group as default but still no internet. I have also included pics of what I did. Any suggestions?

                V 1 Reply Last reply Reply Quote 0
                • V
                  viragomann @CloudNode
                  last edited by

                  @iptvcld
                  The gateway and gateway group are looking correctly, but you have to troubleshoot the gateway monitoring problem.
                  Ensure that pinging 8.8.8.8 from 192.168.2.81 is allowed on the master and that there is an outbound NAT rule present on WAN for that source.

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    CloudNode @viragomann
                    last edited by

                    @viragomann I did a test from my master to ping out to 8.8.8.8 and that works ok.

                    Also on master; this is what my outbound nat section looks like. I can see under source there is y LAN network 192.168.2.0/24

                    788a425d-b88e-4a73-89f7-fd793c21757c-image.png

                    I am not too sure what else i should be looking at; would really appreciate your help. thank you!

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @CloudNode
                      last edited by

                      @iptvcld
                      I think, I've forgotten something:
                      On the secondary you will need to add an outbound NAT rule to LAN for 127.0.0.0/8 and switch into hybrid mode.

                      C 1 Reply Last reply Reply Quote 0
                      • C
                        CloudNode @viragomann
                        last edited by

                        @viragomann Thanks; so on my backup PF i did the below:
                        c4821726-a187-4e34-a697-59199560e1b7-image.png

                        This did not work still then i tried this
                        2238c034-3db5-4684-9350-21da03cc81df-image.png

                        But this did not work as well.

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @CloudNode
                          last edited by

                          @iptvcld
                          Keep the first one.

                          Tried to restart the machine?

                          If it still doesn't take a packet capture on the LAN interface. You should see periodic pings to 8.8.8.8. As well you should see them on the masters LAN and also on the masters WAN if it works as expected.

                          C 1 Reply Last reply Reply Quote 0
                          • C
                            CloudNode @viragomann
                            last edited by

                            @viragomann I also just noticed since i made this NAT mode change from auto to hybrid and also adding the mapping on my backup PF; after the reboot, it reverted back to auto and got rid of the mapping as my master sync'd over. Should i be making this change on my master then?

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @CloudNode
                              last edited by

                              @iptvcld
                              Yes, you can add this rule to the master as well. It won't be used there anyway.

                              C 1 Reply Last reply Reply Quote 0
                              • C
                                CloudNode @viragomann
                                last edited by

                                @viragomann i did this on the master now and i saw it synced over to the backup. I rebooted the backup again as well.
                                dcb43cb0-d713-43ba-8b64-c9b34c82fc11-image.png

                                I ran a packet capture on the LAN (backup pf) and i see a few of these lines. IP: 76.64.x.x is my wan
                                10:54:16.598225 IP 76.64.x.x > 8.8.8.8: ICMP echo request, id 13920, seq 321, length 9

                                but GW still shows offline
                                cbfaf116-dab6-4bb1-b620-ed5fbda515d0-image.png

                                When i run a ping to 8.8.8.8 using backup, i get this

                                PING 8.8.8.8 (8.8.8.8): 56 data bytes
                                64 bytes from 8.8.8.8: icmp_seq=0 ttl=115 time=2.599 ms

                                --- 8.8.8.8 ping statistics ---
                                3 packets transmitted, 1 packets received, 66.7% packet loss
                                round-trip min/avg/max/stddev = 2.599/2.599/2.599/0.000 ms

                                V 1 Reply Last reply Reply Quote 0
                                • V
                                  viragomann @CloudNode
                                  last edited by viragomann

                                  @iptvcld said in pfSense HA LAN Interfaces Only:

                                  I ran a packet capture on the LAN (backup pf) and i see a few of these lines. IP: 76.64.x.x is my wan
                                  10:54:16.598225 IP 76.64.x.x > 8.8.8.8: ICMP echo request, id 13920, seq 321, length 9

                                  Even if the WAN cable is disconnected??
                                  I was assuming that the WAN is offline, so not clear, why it use the WAN IP.

                                  C 1 Reply Last reply Reply Quote 0
                                  • C
                                    CloudNode @viragomann
                                    last edited by

                                    @viragomann That is correct Sir; i do not have my WAN connected to my backup pf right now

                                    8288f915-22ad-4cef-a7e2-8a1e05342ff8-image.png

                                    V 1 Reply Last reply Reply Quote 0
                                    • V
                                      viragomann @CloudNode
                                      last edited by

                                      @iptvcld
                                      Not clear, what's wrong here.
                                      As first step for troubleshooting you can remove the monitoring IP from the LAN gateway on the backup. Hence it should monitor the masters LAN and the gateway state should get online.
                                      But not sure if the failover will work after.

                                      C 2 Replies Last reply Reply Quote 0
                                      • C
                                        CloudNode @viragomann
                                        last edited by

                                        @viragomann I ran a packet cap again and i am seeing those monitoring requests come in as well:

                                        11:14:31.073869 IP 8.8.8.8.853 > 192.168.2.81.17018: tcp 0
                                        11:14:31.073887 IP 76.64.x.x.11762 > 8.8.8.8.853: tcp 0

                                        V 1 Reply Last reply Reply Quote 0
                                        • C
                                          CloudNode @viragomann
                                          last edited by

                                          @viragomann When i remove the monitoring ip from the GW; yes it puts the master LAN IP in there and yes it shows Green and Online but no internet.

                                          Ah i really hoped this would have worked out; was such a nice idea to have.

                                          1 Reply Last reply Reply Quote 0
                                          • V
                                            viragomann @CloudNode
                                            last edited by

                                            @iptvcld said in pfSense HA LAN Interfaces Only:

                                            I ran a packet cap again and i am seeing those monitoring requests come in as well:
                                            11:14:31.073869 IP 8.8.8.8.853 > 192.168.2.81.17018: tcp 0
                                            11:14:31.073887 IP 76.64.x.x.11762 > 8.8.8.8.853: tcp 0

                                            So you're using 8.8.8.8 for DNS resolution as well.
                                            Possibly that's an issue when you've stated the WAN gateway in System > General Setup.
                                            However, when using this IP for gateway monitoring, pfSense will automatically add a static route and point it to the respective gateway. So there might be a conflict.

                                            As mentioned above, you can use any other public IP for gateway monitoring which is responding to pings. It might be a good idea, to use another IP.

                                            Also you should have a check at System > Advanced > Miscellaneous > State Killing on Gateway Failure.

                                            For further testing you can set the WAN gateway as down manually on the backup.

                                            C 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post