Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CARP LAN both are master.

    Scheduled Pinned Locked Moved
    HA/CARP/VIPs
    6
    33
    14.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sullrich
      last edited by

      I need a ipfw show when CP is ENABLED.

      1 Reply Last reply Reply Quote 0
      • D
        dtran
        last edited by

        I'm using all public ip stuff - I sent it to your private email.
        If you can take a look and help me out that will be great.
        I did not want to include the public IPs here.

        Thanks

        1 Reply Last reply Reply Quote 0
        • S
          Sylhouette
          last edited by

          If i use the packet capture (gui) in pfsense for wich packages must i look for.(the missing multicast).
          I do not have fysical access to the router, so i can not go to console.

          Secondly is there a list of switches that work out of the box and which do not.

          I did not replace the switch (we do not have them in stock!!) but i do not use Captive Portal.

          1 Reply Last reply Reply Quote 0
          • D
            dtran
            last edited by

            @Sullrich,
            here is the capture of ipfw show on the 2nd pfsense box in which the LAN CARP is showing as master instead of backup.

            pfsense2:~#  ipfw show
            00030 2537  886901 skipto 50000 ip from any to any in via rl1 keep-state
            00030  490  98976 skipto 50000 ip from any to any in via rl0 keep-state
            00500  272  15232 allow ip from 128.97.205.3 to any out via rl2
            00501    0      0 allow ip from any to 128.97.205.3 in via rl2
            01000  199  35301 skipto 50000 ip from any to any not layer2 not via rl2
            01001  199  35301 allow ip from any to any layer2 not via rl2
            01100    1      28 allow ip from any to any layer2 mac-type 0x0806
            01100    0      0 allow ip from any to any layer2 mac-type 0x888e
            01100    0      0 allow ip from any to any layer2 mac-type 0x88c7
            01100    0      0 allow ip from any to any layer2 mac-type 0x8863
            01100    0      0 allow ip from any to any layer2 mac-type 0x8864
            01100    0      0 allow ip from any to any layer2 mac-type 0x8863
            01100    0      0 allow ip from any to any layer2 mac-type 0x8864
            01100    0      0 allow ip from any to any layer2 mac-type 0x888e
            01101    0      0 deny ip from any to any layer2 not mac-type 0x0800
            01102  192  10752 skipto 20000 ip from any to any layer2
            01200    0      0 allow udp from any 68 to 255.255.255.255 dst-port 67 in
            01201    0      0 allow udp from any 68 to 128.97.205.3 dst-port 67 in
            01202    0      0 allow udp from 128.97.205.3 67 to any dst-port 68 out
            01203    0      0 allow icmp from 128.97.205.3 to any out icmptypes 8
            01204    0      0 allow icmp from any to 128.97.205.3 in icmptypes 0
            01300    0      0 allow udp from any to 128.97.205.3 dst-port 53 in
            01301    0      0 allow udp from 128.97.205.3 53 to any out
            01302    0      0 allow tcp from any to 128.97.205.3 dst-port 8000 in
            01303    0      0 allow tcp from 128.97.205.3 8000 to any out
            01304    0      0 allow tcp from any to 128.97.205.3 dst-port 8001 in
            01305    0      0 allow tcp from 128.97.205.3 8001 to any out
            10000    0      0 skipto 50000 ip from any to 128.97.186.150 in
            10000    0      0 skipto 50000 ip from 128.97.186.150 to any out
            10001    0      0 skipto 50000 ip from any to 128.97.229.250 in
            10001    0      0 skipto 50000 ip from 128.97.229.250 to any out
            10002    0      0 skipto 50000 ip from any to 164.67.128.1 in
            10002    0      0 skipto 50000 ip from 164.67.128.1 to any out
            10003    0      0 skipto 50000 ip from any to 164.67.128.2 in
            10003    0      0 skipto 50000 ip from 164.67.128.2 to any out
            10004    0      0 skipto 50000 ip from any to 164.67.62.100 in
            10004    0      0 skipto 50000 ip from 164.67.62.100 to any out
            10005    0      0 skipto 50000 ip from any to 164.67.62.101 in
            10005    0      0 skipto 50000 ip from 164.67.62.101 to any out
            10006    0      0 skipto 50000 ip from any to 164.67.62.102 in
            10006    0      0 skipto 50000 ip from 164.67.62.102 to any out
            10007    0      0 skipto 50000 ip from any to 169.232.33.135 in
            10007    0      0 skipto 50000 ip from 169.232.33.135 to any out
            10008    0      0 skipto 50000 ip from any to 169.232.35.150 in
            10008    0      0 skipto 50000 ip from 169.232.35.150 to any out
            10009    0      0 skipto 50000 ip from any to 169.232.46.139 in
            10009    0      0 skipto 50000 ip from 169.232.46.139 to any out
            10010    0      0 skipto 50000 ip from any to 169.232.47.139 in
            10010    0      0 skipto 50000 ip from 169.232.47.139 to any out
            10011    0      0 skipto 50000 ip from any to 169.232.48.139 in
            10011    0      0 skipto 50000 ip from 169.232.48.139 to any out
            10012    0      0 skipto 50000 ip from any to 169.232.48.157 in
            10012    0      0 skipto 50000 ip from 169.232.48.157 to any out
            19902    0      0 fwd 127.0.0.1,8000 tcp from any to any dst-port 80 in
            19903    0      0 allow tcp from any 80 to any out
            19904  192  10752 deny ip from any to any
            29900  192  10752 allow ip from any to any layer2
            65535 3229 1021346 allow ip from any to any

            1 Reply Last reply Reply Quote 0
            • S
              sullrich
              last edited by

              I just commited some fixes for this.  Please install a snapshot from http://snapshots.pfsense.com/FreeBSD6/RELENG_1_2/updates/ in 2-3 hours from now.

              1 Reply Last reply Reply Quote 0
              • D
                dtran
                last edited by

                I updated firmware on both boxes.  It is showing:

                1.2-RC3
                built on Mon Dec 10 16:14:30 EST 2007

                anyway, the new firmware still showing the same status as before. 
                On the 2nd box, wan-carp is "back-up" and lan-carp status is still "master" when captive portal is enabled on the 2nd box.  At the same time, box #1 is showing both wan-carp and lan-carp as master (captive portal also enabled),

                Also, when I manually disable captive portal on the second box, console via com port is showing:

                IP firewall unloaded
                Warning: memory type IpFw/IpAcct leaked memory on destroy (1 allocations, 1024 b
                ytes leaked).
                ipfw2 (+ipv6) initialized, divert loadable, rule-based forwarding enabled, defau
                lt to accept, logging disabled

                1 Reply Last reply Reply Quote 0
                • S
                  sullrich
                  last edited by

                  Do you see two new rules of "ipfw show" that mention carp and pfsync?

                  1 Reply Last reply Reply Quote 0
                  • D
                    dtran
                    last edited by

                    no - I did not see that at all.
                    I compared the old output and new and they are nearly identical.
                    Let me look closer.

                    edit:  I did not see anything different.

                    1 Reply Last reply Reply Quote 0
                    • S
                      sullrich
                      last edited by

                      Tell me if /etc/inc/captiveportal.inc has pfsync and carp in it.

                      You can do this from a shell: cat /etc/inc/captiveportal.inc | grep pfsync

                      1 Reply Last reply Reply Quote 0
                      • D
                        dtran
                        last edited by

                        No. nothing there.
                        grep for pfsync in /etc/inc/captiveportal.inc does not show any occurrence of pfsync.

                        1 Reply Last reply Reply Quote 0
                        • S
                          sullrich
                          last edited by

                          Then you must have upgraded before the snapshot server created the newer images.

                          Please upgrade to an image from http://snapshots.pfsense.com/FreeBSD6/RELENG_1_2/updates/pfSense-Full-Update-1.2-RC3.tgz

                          1 Reply Last reply Reply Quote 0
                          • D
                            dtran
                            last edited by

                            do you have the full-embedded image because that's what I'm using here.
                            Thanks

                            edit: I'm getting the pfSense-Embedded-Update-1.2-RC3.tgz - will that work?

                            edit 2:  I upgraded both boxes with new image.
                            cat /etc/inc/captiveportal.inc | grep pfsync is not showing anything.

                            The 2nd box is still showing "master" on lan-carp when captiveportal is enabled.
                            I guess the pfSense-Embedded-Update-1.2-RC3.tgz does not have the patch.
                            system overview is showing: 
                            1.2-RC3
                            built on Tue Dec 11 11:52:19 EST 2007

                            1 Reply Last reply Reply Quote 0
                            • S
                              sullrich
                              last edited by

                              Reinstall from a recent snapshot then, please.

                              1 Reply Last reply Reply Quote 0
                              • D
                                dtran
                                last edited by

                                Do you mean you want me to physdiskwrite using the pfSense-Embedded-Update-1.2-RC3.tgz rather than the firmware load via the GUI ?

                                1 Reply Last reply Reply Quote 0
                                • S
                                  sullrich
                                  last edited by

                                  Yep.

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    dtran
                                    last edited by

                                    I'm sorry, I think i am missing something elementary here.
                                    physdiskwrite using the pfSense-Embedded-Update-1.2-RC3.tgz - cannot boot after that

                                    Using an older image, I can boot up just fine.

                                    I notice that, with the new imagem using physdiskwrite I get:

                                    Found compressed image file
                                    62023680/62023680 bytes written in total

                                    and using and older image, I get:
                                    Found compressed image file
                                    122441728/122441728 bytes written in total

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      sullrich
                                      last edited by

                                      http://snapshots.pfsense.com/FreeBSD6/RELENG_1_2/embedded/pfSense.img.gz .. That other file was an update file.. Sorry.

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        dtran
                                        last edited by

                                        Reinstalled from scratch using the suggested snapshot.
                                        Problem is still there. 
                                        2nd box is still showing lan-carp as master when captive portal is enabled.

                                        cat /etc/inc/captiveportal.inc | grep pfsync is not showing anything.

                                        note: reinstall done on both boxes..

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          dtran
                                          last edited by

                                          Hi,
                                          Any new development on this ? - Thanks

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            sullrich
                                            last edited by

                                            Our snapshot system is busted currently.  There is an open ticket that I need to check into.

                                            In the meantime, replace /etc/inc/captiveportal.inc with http://pfsense.com/cgi-bin/cvsweb.cgi/pfSense/etc/inc/captiveportal.inc?rev=1.58.2.42.2.6;content-type=text%2Fplain;only_with_tag=RELENG_1_2

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post