Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    TCP Problems like unsymetric routing with CARP

    HA/CARP/VIPs
    1
    1
    430
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      blex
      last edited by

      Hi,

      maybe you have an idear.

      I have two PFSense boxes (Server). The Server have two 10Gbit nic's. They are configured as a lagg in failover. Ontop of that there are many vlans.
      Each vlan has its own interface.

      I have always 192.168.X.252 for fw1 and 192.168.X.253 for fw2. The carp adresse is 192.168.X.254.
      CARP failover is working fine.

      But then a PC for example in vlan 9 talks to a pc in vlan 20 the tcp backbackages are droped!

      PROD_SRV Default deny rule IPv4 (1PROD_SRV Default deny rule IPv4 (1000000103)   192.168.40.36:49367   192.168.1.27:8194 TCP:PA000000103)   192.168.40.36:49367   192.168.1.27:8194 TCP:PA

      As far as I unserstand pfSense there should be a TCP state and it should recocnise the pakages coming back from 192.168.1.27 to 192.168.40.36 since 192.168.40.36 created the connection.
      Could this happen bause 192.168.1.27 has the CARP IP address as default GW AND the inital pakage has traveld from 192.168.40.36 to the carp through the fw and then exited on 192.168.1.252 to reach 192.168.1.27.

      How can I bring the fw to use the CARP IP for routing outgoing pakages instead if its lokal IP?

      Hope someone can point out how to fix this problem.

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.