CARP / DMZ / VIPs (fixed)

seanlee · Jun 24, 2009, 6:02 PM

Hello,

I figured I'd update my post with a bit more info…

I cannot figure out how to get a DMZ up and running using a virtual IP and 1:1 NAT. I have a load balancer (ha-proxy) that I want to put in the DMZ, that will serve traffic to VM's on the LAN, and I want a virtual IP to forward traffic to it so that if one firewall goes down, the VIP will failover to the 2nd firewall. This way, the load balancer never becomes unreachable.

I have 2 pfsense FW's functioning w/ failover. These are all VMware wirtual machines. Each firewall has 4 NICs assigned to it.

Here's what it looks like (CARP NIC3 and DMZ NIC is not shown):

Here's my current config (same on each FW)

WAN: External IP (/24)
LAN: 10.10.15.0 (/20)
FAILOVER/OPT1: setup properly (virtual IP for LAN is 10.10.15.250 /20)
DMZ: ?

All firewall rules are setup for WAN/LAN/DMZ/CARP/NAT to ALLOW ANY to ANY

Questions: ???
1. The DMZ has it's own NIC assigned to it (NIC4). Do I give the DMZ interface an internal IP or external?
2. I know how to create VIP's, but I don't understand how to make a VIP that I can use for 1:1 NAT traffic to the DMZ.
3. Is the VIP a CARP type address or pARP type address? I would assume CARP if I want it to failover.
4. Do I tell the VIP to listen on the DMZ interface?
5. Is there a better way to do what I'm trying to do?

Thanks in advance,

-Sean

seanlee · Jun 24, 2009, 6:02 PM

Figured it out.

I followed the guide to setup CARP here:
http://www.pfsense.org/mirror.php?section=tutorials/carp/carp-cluster-new.htm

And then did the following:

Firewall 01
1. WAN address: [external IP]
2. LAN address: 10.10.16.254/24
3. FAILOVER (OPT1) address: 10.10.16.251/24
4. DMZ (OPT2) address: 10.10.15.254/20

Firewall 02
1. WAN address: [external IP]
2. LAN address: 10.10.16.252/24
3. FAILOVER (OPT1) address: 10.10.16.250/24
4. DMZ (OPT2) address: 10.10.15.252/20

Virtual IP's
1. (cARP) 10.10.16.253 - used as LAN gateway address for internal machines
2. (cARP) 10.10.15.253 - used as DMZ gateway address for internal machines
3. (cARP) [external ip] - used for external load balancer IP. NAT'd 1:1 (using WAN interface) to internal address on DMZ

Now I get the luxury of fault tolerance with the internal gateway addresses as well as the external IP that DNS will be directed at.