OpenVPN with master/slave setup

[stokbaek]

Hello,

I am kinda in a bind. I have made a setup with a site A and site B. Both sides have a master/slave setup.

I have a nagios server that is checking what server CARP is running on. Nagios server is in site A but it have to check in site A and B. Problem here is that slave in site B doesn't have a route to the OpenVPN. I have tried with NAT but couldn't get it to work, guessing I did it wrong so would be great if someone could help me with this.

This is how the top looks like

–- SITE A ------
FW 1 ---- FW 2
|              |
--CARP IP--
        |  |
WAN |  | OpenVPN
        |  |
--CARP IP--
|              |
FW 1 ---- FW 2
--- SITE B ------

Its on the newest version on PfSense.
/stokbaek

[viragomann]

Take a look in the doc:
https://doc.pfsense.org/index.php/CARP_Secondary_Unreachable_Over_VPN

[fmroeira86]

Hi,

I'm having the same issue so I created the outbound nat.

It works fine but you can't set the destionation as "ALIAS".

Is it supposed to be this way?

I would like to NAT only the traffic going to the SLAVE and MASTER FW.

Thanks

[viragomann]

Hi,

to get the rule work for master and slave, you either need a separate NAT rule for each of them or you add an Alias first in Firewall > Aliases, which contains both, the masters and slaves LAN IP. Then you can use this Alias in a single NAT rule.

For instance, mine looks like this:
LAN  10.0.41.0/24 * FW1a2_LAN * LAN address * NO

[fmroeira86]

I can not use an Alias with outbound nat.

Can you share a print screen?

[viragomann]

Yes, you're right. You have to select "Network" at destination type and enter your alias in the field below.