Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Outbound NAT using CARP IP

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    2 Posts 2 Posters 427 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fvtech
      last edited by fvtech

      Hello!

      I recently configured a pair of XG-7100 appliances in High Availability. Everything works properly, except when specifying the CARP Virtual IP on the WAN interface as the source address for outbound NAT. Both appliances are connected to the modem/switch provided by the ISP.

      I have a /29 subnet. I'm using the following IP addresses:

      CARP IP = 24.138.x.67
      GW1 WAN = 24.138.x.68
      GW2 WAN = 24.138.x.69

      Using the default NAT rules, traffic flows normally. However, when I configure a rule to use the CARP Virtual IP as the address used for translation, traffic does not flow outbound.

      Trying to ping the ISP router (24.138.x.65) using the source interface as the CARP Virtual IP fails. The ISP router can be pinged from all other interfaces. I cannot ping my CARP Virtual IP from another external network (Cellular as an example).

      Is this an issue with the ISP, or am I missing something as part of my configuration?

      Any help is appreciated! Thanks a bunch!

      EDIT: Typo - cannot ping the CARP virtual IP externally

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by Derelict

        Sounds like your ISP is not compatible with CARP. Some aren't.

        https://forum.netgate.com/topic/134297/cox-and-the-carp-mac/
        https://forum.netgate.com/topic/146254/carp-outgoing-traffic-black-hole/

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.