A couple of thoughts on the CARP VIP setting in pfBlockerNG-devel 2.2.5_19.



  • Just a couple of thoughts on using the CARP VIP setting in pfBlockerNG-devel 2.2.5_19.

    1. Setting VIP to CARP results in the same base and skew values on both the primary and secondary routers, causing uncertainty on which interface adopts MASTER status. I assume that when the incorrect interface adopts MASTER status that this will result in timeouts when the DNSBL Webserver needs to be accessed? Also, base and skew values can sometimes be too short on some LAN scenarios.
      pfSense allows the user to manually choose base and skew when setting up CARP VIPs as that can help with any timing issues on the LAN. It would be good to see that level of control in pfBlockerNG-devel.

    2. pfBlockerNG-devel sets a VHID of 1 to the CARP VIP on my system (YMMV). I assume that's because pfBlockerNG-devel finds the next available VHID on the interface. However, what if the user has other devices on the LAN that use the same VHID value? There is no way for pfBlockerNG-devel to know that, so I expect that the broadcast nature of CARP or VRRP would cause redundancy conflicts in such scenarios.
      pfSense allows the user to manually set VHID to avoid redundancy conflicts, and it would be great to allow the user to do the same in pfBlockerNG-devel.

    We CARP VIP users are not afraid of making manual configurations :)

    That's all I've got.
    Regards,


  • Moderator

    @silentnomad

    This will be fixed in the next devel release...



  • @bbcan177
    Thank you, sir! pfBlockerNG-devel is a great upgrade. I really like the IP and domain block feeds list :)