Accessing the slave from remote networks

bakisho

Hello
I work with PF-Sense for a few years and I use HA.
I have a problem that I never understood how to solve...
I can't access the slave server from remote networks.
I know it can be solved using a NAT rule, but never understood how to implement it.

SteveITS

@bakisho If you’re using a NAT forward it’s probably
https://docs.netgate.com/pfsense/en/latest/troubleshooting/asymmetric-routing.html

Derelict

@steveits https://docs.netgate.com/pfsense/en/latest/troubleshooting/ha-vpn-secondary.html

bakisho

@derelict
Thanks, this is what I was looking for.
But, The implementation is not clear (to me).
I don't understand "destination being an alias that contains both the primary and secondary node LAN IPs"

for example,
my LAN is 192.168.0.0/24
my master is 192.168.0.2
my slave is 192.168.0.3
Carp IP is 192.168.0.1
VPN is 172.18.80.0/24

So I need to create an outbound NAT rule on the Master .
Interface: LAN
Source: VPN 172.18.80.0/24
Destination: LAN 192.168.0.0/24
Address: Interface Address

What am I missing ???

Derelict

@bakisho You probably don't want it to be so wide because you might not want to NAT to everything on the LAN, just to the other node.

Make a host alias containing:

192.168.0.2 and 192.168.0.3

Use that alias as the destination.

You make the alias using both so it will match the traffic when run on the primary and when synced to the secondary.

bakisho

@derelict
IT WORKS!
Thank you