Multi-Pfsense firewall CARP and NAT Help



  • I have made a simple diagram with what I am trying to achieve and have provided an explanation.
    0_1550208315807_Untitled Diagram.png

    I want to have 2 PFSense firewalls (virtual) on two different hosts which have two directly connected WAN networks. My servers currently are connected via a shared switch on the LAN. When I create this setup everything works. going to DNAT ports via public IP of master forwards to the internal just fine. And failover to the slave DNAT works too.

    What I want to do is have a shared CARP IP as a GW of my servers and allow traffic to go to either pfsense via public IP and get NATed to the server and go back out the pfsense it came in. Currently if I send traffic into the slave pfsense, it nats' to the server but the server then sends it to the master.

    Is there a way for me to make this setup have a reply-to tag based on which firewall the traffic came to the server from so it can source nat properly?



  • Hello there! Sorry, I couldn't understand your words clearly. So may you elaborate more on what you are trying to achieve with your setup?


  • LAYER 8 Netgate

    You need a WAN CARP VIP on each WAN and set Outbound NAT to use that.

    What you have is an invalid HA configuration. Both WANs should be on both firewalls in a Multi-WAN configuration.


Log in to reply