Two Firewall, Two Separate WAN, One virtual LAN Gateway IP
Per the title, I have two pfsense firewalls, each has a WAN address from different providers.
LAN 192.168.1.x -> pf1 -> WAN 22.214.171.124
LAN 192.168.1.x -> pf2 -> WAN 126.96.36.199
Gateway Groups work flawlessly if I set the LAN gateway address as ONE of the firewalls. If I use gateway groups in both firewalls and a CARP VIP as the LAN gateway, the state of WAN interfaces isn't synced and this impacts service in unexpected ways.
LAN pf1 –->WAN
LAN pf2 ---->WAN
The goal is: when a WAN interface goes down, just move all traffic to the other firewall. I'm sure I'm not thinking about this the right way using the tools available in pfsense. Help me get unstuck.
awebster last edited by
Each pfsense has a separate WAN connection with a separate provider, yet you have them configured as a cluster?
Is so, what you are trying to do doesn't make sense, there is no state information that can be shared because each one has a different WAN connection.
I guess I was wrong to use a CARP VIP then? There's no rule that says it has to be a cluster.
If there's another way to share a VIP that a pfsense app can manage, then I'm wide open to that.
Yes, there is. Configure your machines as real HA with CARP as it should be:
And then set up a Multi-WAN configuration with the two ISPs: