Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CARP with a single public IP?

    Scheduled Pinned Locked Moved
    HA/CARP/VIPs
    6
    11
    5.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GruensFroeschliG
      GruensFroeschli
      last edited by

      not possible with only one IP

      We do what we must, because we can.

      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

      1 Reply Last reply Reply Quote 0
      • dotdashD
        dotdash
        last edited by

        You can do this with CARPDEV under OpenBSD. This functionality has not been ported to FreeBSD, and so is not available in pfSense.

        1 Reply Last reply Reply Quote 0
        • H
          hot_rene
          last edited by

          thanks a lot for the help guys :)

          1 Reply Last reply Reply Quote 0
          • H
            hot_rene
            last edited by

            and one more question, do i need 2 or 3 public IPs?

            1 Reply Last reply Reply Quote 0
            • M
              morbus
              last edited by

              3 one for each real box and the CARP VIP that the share
              ie 1.2.3.1 -> pf1
                1.2.3.2 -> pf2
                1.2.3.3 -> CARP

              1 Reply Last reply Reply Quote 0
              • H
                hot_rene
                last edited by

                :o oo thanks a lot for the info.
                and when i configure my pfsense fws, what vhid should i use for all interfaces than in the case, including the carp interface with a public VIP?
                ???

                1 Reply Last reply Reply Quote 0
                • M
                  morbus
                  last edited by

                  Use a different vhid for each CARP VIP

                  1 Reply Last reply Reply Quote 0
                  • I
                    Itwerx
                    last edited by

                    At risk of hijacking the thread.

                    Does anyone know the full technical rationale behind this limitation? 
                      Seems to me any set of IPs in the same subnet should logically be usable for CARP.  Is it simply because CARP was not originally intended for this sort of thing and whomever made the original design decision just didn't consider that it might be used in a scenario outside of the private network…?

                    (Or am I just missing some fundamental aspect of CARP functionality that makes this requirement logical and appropriate?  :)

                    1 Reply Last reply Reply Quote 0
                    • S
                      sullrich
                      last edited by

                      CARP is multicast.  Unless your ISP is blocking this traffic you could be stepping on an upstream VRRP host or even another CARP host.

                      1 Reply Last reply Reply Quote 0
                      • I
                        Itwerx
                        last edited by

                        …any set of IPs in the same subnet...
                        @sullrich:

                        CARP is multicast.  Unless your ISP is blocking this traffic you could be stepping on an upstream VRRP host or even another CARP host.

                        On re-reading I really didn't say that very well!  :/
                          What I meant was any set of IPs that were on their own subnet, but separate from the existing public IP.  E.g. the public IP could 1.2.3.4 but the CARP stuff could all take place on 10.1.1.1, 10.1.1.2 and 10.1.1.3 which the ISP shouldn't care about. 
                          Since the CARP functionality is intended to detect and recover from hardware failures it really shouldn't matter what IPs it's using behind the scenes, right? 
                          (And upon some research it looks like this capability is actually being added to CARP right now - would be very nice to have in pfSense!  :)

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post