TCP Problems like unsymetric routing with CARP

  • Hi,

    maybe you have an idear.

    I have two PFSense boxes (Server). The Server have two 10Gbit nic's. They are configured as a lagg in failover. Ontop of that there are many vlans.
    Each vlan has its own interface.

    I have always 192.168.X.252 for fw1 and 192.168.X.253 for fw2. The carp adresse is 192.168.X.254.
    CARP failover is working fine.

    But then a PC for example in vlan 9 talks to a pc in vlan 20 the tcp backbackages are droped!

    PROD_SRV Default deny rule IPv4 (1PROD_SRV Default deny rule IPv4 (1000000103) TCP:PA000000103) TCP:PA

    As far as I unserstand pfSense there should be a TCP state and it should recocnise the pakages coming back from to since created the connection.
    Could this happen bause has the CARP IP address as default GW AND the inital pakage has traveld from to the carp through the fw and then exited on to reach

    How can I bring the fw to use the CARP IP for routing outgoing pakages instead if its lokal IP?

    Hope someone can point out how to fix this problem.

Log in to reply