Multi-Pfsense firewall CARP and NAT Help
-
I have made a simple diagram with what I am trying to achieve and have provided an explanation.
I want to have 2 PFSense firewalls (virtual) on two different hosts which have two directly connected WAN networks. My servers currently are connected via a shared switch on the LAN. When I create this setup everything works. going to DNAT ports via public IP of master forwards to the internal just fine. And failover to the slave DNAT works too.
What I want to do is have a shared CARP IP as a GW of my servers and allow traffic to go to either pfsense via public IP and get NATed to the server and go back out the pfsense it came in. Currently if I send traffic into the slave pfsense, it nats' to the server but the server then sends it to the master.
Is there a way for me to make this setup have a reply-to tag based on which firewall the traffic came to the server from so it can source nat properly?
-
Hello there! Sorry, I couldn't understand your words clearly. So may you elaborate more on what you are trying to achieve with your setup?
-
You need a WAN CARP VIP on each WAN and set Outbound NAT to use that.
What you have is an invalid HA configuration. Both WANs should be on both firewalls in a Multi-WAN configuration.
