Help setting up multiple public IPs

Deadringers

have you tried using proxy arp as virtual ip's

I looked at that but then I couldn't use it to bind services to (which is something I'd like to do) and I couldn't ping it etc.

miloman

have you read this? https://doc.pfsense.org/index.php/What_are_Virtual_IP_Addresses%3F

Deadringers

Okay so I made a bit of progress!

I can ping those vips from my lan and get a reply!

But i cannot see any traffic coming into my wan when I ping from an outside adress…

I have done a full packet capture on my wan interface but I can't see any packets coming in with the destinationaddress for my vips.

Which would suggest that the trafficc isn't being routed to my wan address?

miloman

Which would suggest that the trafficc isn't being routed to my wan address?

yes… are you running this as a virtual firewall by any chance?

Deadringers

@miloman:

Which would suggest that the trafficc isn't being routed to my wan address?

yes… are you running this as a virtual firewall by any chance?

Yea within esxi 5.1

miloman

try doing this: https://doc.pfsense.org/index.php/CARP_Configuration_Troubleshooting

this part:
VMware ESX/ESXi Users
1. Enable promiscuous mode on the vSwitch
2. Enable "MAC Address changes"
3. Enable "Forged transmits"
4. If you have multiple physical ports on the same vswitch, you must enable the Net.ReversePathFwdCheckPromisc option to work around a vswitch bug where multicast traffic will loop back to the host, causing CARP to not function with "link states coalesced" messages. (See below)

edit: since you can already ping the vip's from lan (i assume you mean through your switch, and not from another virtual box, then the fix above probably won't help.

Deadringers

@miloman:

try doing this: https://doc.pfsense.org/index.php/CARP_Configuration_Troubleshooting

this part:
VMware ESX/ESXi Users
1. Enable promiscuous mode on the vSwitch
2. Enable "MAC Address changes"
3. Enable "Forged transmits"
4. If you have multiple physical ports on the same vswitch, you must enable the Net.ReversePathFwdCheckPromisc option to work around a vswitch bug where multicast traffic will loop back to the host, causing CARP to not function with "link states coalesced" messages. (See below)

edit: since you can already ping the vip's from lan (i assume you mean through your switch, and not from another virtual box, then the fix above probably won't help.

Thanks for that - I already had those 3 options enabled as I thought it would probably drop the traffic unless they were.

the 4th though I think doesn't matter as there is only 1 physical port connected to my vswitch.

Hmm BT want me to use their modem 1st to see that the IPs are there…

I'd be happy to troubleshoot this further but my problem is I don't understand how they are "routing" the traffic down my phone line and what their servers are expecting to see from my end.

miloman

just make sure to post the solution when you find it… it might help others in the future. :)

Deadringers

okay this gets weird now…

for some reason my PPPoE connection picks up an address (random 82.X.X.X address) not the weird part..

the weird part is that the default gateway for this WAN 82.X.X.X address is a 172.16 address!

no idea what BT have done here...

Deadringers

got and email from BT today..
turns out they hadn't actually setup my static IPs yesterday!

it's happening today.

:(

I'll keep you updated on my final config once I know it's working.

Deadringers

Okay i have this all up and running - the issue was that BT had not setup the bloody service despite telling me several times they had!

So here is how to setup BT Business infinity with 5 IPs on PFsense:

WAN:
Have this setup on PPPoE as usual with the correct user name and password which was provided to you.
N.B. both the user name and password are case sensitive so make sure you get it right!

You'll then pick up a random dynamic IP on your WAN interface for general internet access.

VIPs (your 5 static IPs)
All you need to do here is on the web gui go: Firewall > Virtual IPs
Then depending on what kind of VIP you want just create 1 VIP for each static IP you have.
my settings:
Type: IP Alias
Interface: WAN
IP Address(es): type: Single address, Address: x.x.x.x / 29

Press save and you are done!

Now you can play around and NAT things 1:1 or just port forward all you want.

Enjoy!