TCP Problems like unsymetric routing with CARP

blex · Nov 12, 2017, 12:52 AM

Hi,

maybe you have an idear.

I have two PFSense boxes (Server). The Server have two 10Gbit nic's. They are configured as a lagg in failover. Ontop of that there are many vlans.
Each vlan has its own interface.

I have always 192.168.X.252 for fw1 and 192.168.X.253 for fw2. The carp adresse is 192.168.X.254.
CARP failover is working fine.

But then a PC for example in vlan 9 talks to a pc in vlan 20 the tcp backbackages are droped!

PROD_SRV Default deny rule IPv4 (1PROD_SRV Default deny rule IPv4 (1000000103) 192.168.40.36:49367 192.168.1.27:8194 TCP:PA000000103) 192.168.40.36:49367 192.168.1.27:8194 TCP:PA

As far as I unserstand pfSense there should be a TCP state and it should recocnise the pakages coming back from 192.168.1.27 to 192.168.40.36 since 192.168.40.36 created the connection.
Could this happen bause 192.168.1.27 has the CARP IP address as default GW AND the inital pakage has traveld from 192.168.40.36 to the carp through the fw and then exited on 192.168.1.252 to reach 192.168.1.27.

How can I bring the fw to use the CARP IP for routing outgoing pakages instead if its lokal IP?

Hope someone can point out how to fix this problem.