CARP with 1 IP
-
Did some live testing on this today. The configuration was a simulation of a single WAN setup where you only have a single IP assigned and want to run a pair of firewalls for redundancy. I used a pair of firewalls with three interfaces running 2.2 x64. One LAN, one WAN, and SYNC.
I did a fairly standard CARP setup on them, the one difference being I used private ips on the WAN. I added a single CARP vip on the WAN with the public IP and real subnet. Others have mentioned matching the fake WAN subnet to the real WAN subnet- in my case it didn't make a difference, perhaps because I wasn't stacking alias vips on the CARP. I added the real gateway from system, routing and set it as default. I then added the gateway on the WAN interface. It didn't seem to make a functional difference, but I think it would in a multi-WAN setup. Failover and failback seemed to work fine. The one issue I had was that the secondary was not accessible from the outside. The primary worked normally once I created an access rule allowing https traffic to the public vip. I tried various port-forward tricks, as suggested by ITI, but couldn't get them to work.
My production uses of this will probably involve setups with a larger subnet routed via a /30 transport and multiple WANs, so I'll have to see how those factors change the config, but the test worked well for a single WAN with one public ip. -
Ok, I'm back at it trying to do failover with a /30 circuit. It works, but I can't figure out how to get a gateway group to work with this.
This is multiwan, other WAN has enough publics to put on each firewall. Having to mark the gateway up all the time is not much better than having the line only work on the primary. Anyone figure out how to get a monitor working if the interface is private with a public CARP? Tried adding a nat from private wan, but no joy. -
Without being able to select the CARP VIP as the interface in the gateway config it's going to be a challenge.
-
Perhaps it will require a feature request to work properly…
-
This seems to fit the topic. Since the same subnet restrictions have been removed from CARP, I want to just use 1 IP also. However, Comcast here charges an extra $40 (20 static & 20 for business) a month to get a static IP. Since my IP has not changed in 2 years, I want to use the IP I get from DHCP as my VIP. Easy to do until the lease runs out: Use WAN NIC to get DHCP IP, assign the IP to the CARP VIP, go in WAN interface and spoof MAC address. Now everything should run fine until the lease expires because there is no place to put the MAC in CARP VIP GUI page. How does pfSense decide which MAC to assign to the VIP? Is there a way for the VIP to get a DHCP address that it would continue to renew, so as to avoid problems? If I am way off on this please point me in the right direction.
-
Ok, I'm back at it trying to do failover with a /30 circuit. It works, but I can't figure out how to get a gateway group to work with this.
This is multiwan, other WAN has enough publics to put on each firewall. Having to mark the gateway up all the time is not much better than having the line only work on the primary. Anyone figure out how to get a monitor working if the interface is private with a public CARP? Tried adding a nat from private wan, but no joy.I think this is a GUI issue. From what I've seen if you're using a single WAN IP with CARP, the GUI doesn't have enough options to properly configure apinger. I looked in /var/etc/apinger.conf and it appears the WAN IP is forced as the source IP but unfortunately when doing CARP with one public IP, you have to assign the WAN interface a private IP.
Where can we get a feature request to update the GUI so we can pick the CARP WAN IP or the WAN interface as the source?
tia.
-
I worked around this with the help of another poster. I was able to get the gateway status/failover working by adding an outbound nat rule: WAN 'this firewall' * * * (CARP IP) * NO
Make sure you restart apinger after adding the rule. -
Thanks. There is already a feature request here for it : https://redmine.pfsense.org/issues/4597
-
I tryed this out. Carp with 1 IP on interface with private IPs.
As other Mentioned you need to modify your outbond nat because default rule uses the Interfaces Address. This needs to be changed to the carp IP address.But some things I came accros:
- DHCP Proxy will not work, since it use the Interface IP and DHCP will not find a IP Range. There is no setting to change the CARP of the interface
- I have also Issues with async routing on another setup. There I had the interfaces and the carp in the same network (classig 3 IP setup). To switch over to the 1 IP carp setup didn't resolve it.
-
I, myself, was trying to do the same exact thing. I found this:
https://b3n.org/pfsense-firewall-ha-failover-cluster/
It worked for me.
I did it with my first machine being hardware and my second being virtual with a managed switch.
Just trying to help here.
-
B bigups43 referenced this topic on
