HowTo Set up Single WAN Address CARP with WAN access from both Primary and Secondary :)

MrPete

pfSense documentation for Single-Address CARP says:

When used on a WAN, this type of configuration will only allow communication from the primary node to the WAN, which greatly complicates tasks such as updates, package installations, gateway monitoring, or anything that requires external connectivity from the secondary node.

Here's how to configure so the secondary node also can reach the WAN. Everything is done in System->Routing->Gateways

Add a gateway to your primary internal LAN, that's always enabled. My setup:

Interface: INTLAN
Address fam: IPV4
Name: GW_WAN_IfBackup
Gateway: 192.168.1.1
Description: Gateway when backup
Check BOTH "Disable Gateway Monitoring" and "Disable Gateway Monitoring Action"

Create a Gateway Group that enables the new gateway when the primary one is unavailable:

Name: CARP_WAN_gateways
First one: WAN (WAN_PPPoE for me), Tier 1, Interface Address
Second: GW_WAN_IfBackup, Tier 2, 192.168.1.1 (CARP VIP for LAN)
Trigger Level: Member Down
Description: Priority: the master WAN, then use LAN to other CARP if backup

Set the new Group as the default IPV4 gateway

DONE.
As long as this host is Primary, it should have access to the normal WAN.
If it becomes Backup, it will see WAN as down, and instead connect to primary through the LAN.

That's it :)

elkatarro

@MrPete You, Sir, are a lifesaver! I spent quite a couple of days figuring this out with no avail! Thank you a hundred times!!!