Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Running Two Individual PFSense Box's.

    Scheduled Pinned Locked Moved Hardware
    14 Posts 4 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      You don't have to use a dedicated sync interface on each node. You can send sync data via the LAN for example but it's not recommended.

      Steve

      1 Reply Last reply Reply Quote 0
      • T
        TheHermit
        last edited by

        Check that linked wiki page, this is the way you would connect it:

        https://doc.pfsense.org/index.php/File:CARP_Setup.png

        It means:

        • the boxes need 3 or more interfaces
        • You need at least 1 switch with VLANs or 2 switches
        • HA is configurable in pfSense by default, it's in the menus, instructions are on the same wiki page

        I'll have a look at the guides available as I want too do this, but can I ask. Were does Two Switches come in; instead of VLANS.

        I have three switches hear at home and I'm only using one of them. I have another two in my cupboard so could I use these instead of having a switch that supports VLANS because these do not. Just 10 \ 100  Switches ..

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Common setup would be as in the diagram on the wiki page.

          A switch on the WAN side with the WAN from both nodes and the uplink to the ISP connected to it.

          A switch on the LAN side with the LAN interface from both nodes and other internal resources connected to it.

          If you use VLANs you can segregate ports on one switch to use in both these locations. That does then rely on your switch not ever forgetting it's config and defaulting back to dumb switch mode. We have seen that happen. Too many times!

          Steve

          Edit: typo

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            There is no authentication on the pfsync protocol. If you use LAN there anyone on LAN can probably spoof pfsync states which would effectively be the same as being able to arbitrarily insert firewall rules.

            That is why it is highly-recommended that the SYNC be conducted on a separate interface.

            If you do use one interface you should probably pass pfsync from the other node then block pfsync from LAN net. Note that you will need to create rules on the primary that pass pfsync from its own LAN interface and from the other node's LAN interface. That is probably spoofable, however, as I do not believe there is a response to pfsync required (just like UDP). I have not looked at it in detail.

            In general, if it is worth HA it is worth doing correctly. If you're just labbing for the heck of it, then whatever.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • T
              TheHermit
              last edited by

              Hey,

              I'm just wanting too make sure I have this correct before I attempt too change anything or configure anything.

              I'm looking at the diagram on the Wiki page and I'm also looking at the hardware and my configuration and how I currently have it now.

              So just too be clear:

              WAN Switch > Master PFSense Box (on WAN)    \    Slave PFSense Box (on WAN)    \    Uplink too Internet (Bridged Modem)
              Internet > ISP Box >
                                                  LAN Switch > Master PFSense Box (on LAN)    \    Slave PFSense Box (on LAN)    \    Other Systems and devices

              Would I run an RJ45 Ethernet Cable from WAN Switch too LAN Switch ..

              For convenience have them colour coordinated and placed in a Logical order.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Would I run an RJ45 Ethernet Cable from WAN Switch too LAN Switch ..

                No.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • T
                  TheHermit
                  last edited by

                  @Derelict:

                  Would I run an RJ45 Ethernet Cable from WAN Switch too LAN Switch ..

                  No.

                  In that case would the two PFSense Boxes be connected directly with the Ethernet Cable.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    If you have a third interface, yes. You need an interface for XMLRPC sync and pfsync. If you do not have one, and cannot make a VLAN, that would be the LAN. They will communicate via the switch. No need for a cable.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • T
                      TheHermit
                      last edited by

                      WAN Switch > Master PFSense Box (on WAN)    \    Slave PFSense Box (on WAN)    \    Uplink too Internet (Bridged Modem)
                      Internet > ISP Box >
                                                          LAN Switch > Master PFSense Box (on LAN)    \    Slave PFSense Box (on LAN)    \    Other Systems and devices

                      Is this the correct layout with the two switches ..

                      Also I have been watching YT Videos of PFSense and setting up a HA set up .

                      I just wanted to be clear before I start moving things ect.

                      I like too do my homework first. :D ..

                      Thanks.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        The ASCII diagram is a little unclear.  ;)

                        It should be setup exactly as it is shown in the wiki doc:

                        The top device there, labelled 'DSL router' would be your WAN side switch. Though if you have DSL it could be a DSL router with built in switch potentially.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.