Failover static routes
-
I have 2 pfSense boxes setup like so
pfsense1
WAN 10.0.0.228
LAN 192.168.0.250
Static route from 10.0.0.228 to 10.0.1.96/28 where there 15 additional addresses I get to usepfsense2
WAN 10.0.0.232
LAN 192.168.0.254I use carp to failover between the two and this works fine. Since the 15 additional addresses are mapped to
10.0.0.228 right now those addresses would not failover since the WAN interface is different on the second pfsense box. I asked the ISP what could be a solution for me and this is a quote from them"So the good solution is to use a float GW as destination for that static route
.Does your firewalls have a float gw(that will always be on the active FW) ?
If so we should change static routes to use it"Is this a solution for me and pfSense or is there an alternate way to ensure that when the pfSense1 fails over to pfsense2 that i can continue to access the 15 additional routable addresses? Do you require more information to assist me? I'm happy to provide any additional information you may require.
Thanks
-
I forgot to mention the GW for each pfSense is 10.0.0.225
-
I don't really understand your setup, but try this-
Add a CARP IP in your WAN range, say 10.0.0.230, then use this as your outbound NAT IP. Then use this IP for the route. Since you didn't mention it, make sure you are also using a CARP IP on the LAN (like 192.168.0.252) that the machines are using as their default gateway.
Again, I'm not really clear on how you are using the additional subnet, so I may be off-track… -
The additional subnet is being used to provide access to 15 routable additional ip addresses to the 10 the isp allocated to me originally. In the example i used here all the addresses are private simply as an example. so assume all the 10.0.0 addresses are external addresses available to the internet.
I am using a carp ip on the wan. I did originally setup the carp as described in the online tutorial someome produced for carp setup for pfense. i don't have that link handy right now though
-
Dotdash i sent you a private message with a clarification of how things are setup
