Two Firewall, Two Separate WAN, One virtual LAN Gateway IP

chock-a-block

Per the title, I have two pfsense firewalls, each has a WAN address from different providers.

LAN 192.168.1.x -> pf1 -> WAN 1.2.3.4
LAN 192.168.1.x -> pf2 -> WAN 5.6.7.8

Gateway Groups work flawlessly if I set the LAN gateway address as ONE of the firewalls. If I use gateway groups in both firewalls and a CARP VIP as the LAN gateway, the state of WAN interfaces isn't synced and this impacts service in unexpected ways.

LAN pf1 –->WAN
|
vip gw----|
|
LAN pf2 ---->WAN

The goal is: when a WAN interface goes down, just move all traffic to the other firewall. I'm sure I'm not thinking about this the right way using the tools available in pfsense. Help me get unstuck.

awebster

Each pfsense has a separate WAN connection with a separate provider, yet you have them configured as a cluster?
Is so, what you are trying to do doesn't make sense, there is no state information that can be shared because each one has a different WAN connection.

chock-a-block

I guess I was wrong to use a CARP VIP then? There's no rule that says it has to be a cluster.

If there's another way to share a VIP that a pfsense app can manage, then I'm wide open to that.

viragomann

Yes, there is. Configure your machines as real HA with CARP as it should be:
https://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_(CARP)

And then set up a Multi-WAN configuration with the two ISPs:
https://doc.pfsense.org/index.php/Multi-WAN