CARP VIP not reachable
-
Ok, sounds interesting. Can you please run tcpdump -i vlan1 -n vrrp on pfsense1 and click edit any vip and then save apply on pfsense1?
-
-
i think I run out of ideas… Your carp does not work.
- pfsctl -sr | grep carp
- Try swap nics fxp0 and fxp1.
Sorry
-
pfctl -sr | grep carp
anchor "carp" all
pass in quick on carp0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server on LAN"
pass in quick on carp0 inet proto udp from any port = bootpc to 192.168.50.2 port = bootps keep state label "allow access to DHCP server on LAN"
pass out quick on carp0 inet proto udp from 192.168.50.2 port = bootps to any port = bootpc keep state label "allow access to DHCP server on LAN"
pass out quick on carp0 proto icmp all keep state label "let out anything from firewall host itself"
pass out quick on carp1 all flags S/SA keep state (tcp.closed 5) label "let out anything from firewall host itself"
pass out quick on carp2 all flags S/SA keep state (tcp.closed 5) label "let out anything from firewall host itself"
pass quick proto carp all keep state
pass in quick on carp2 all flags S/SA keep state label "USER_RULE: Trust the Firewall CARP net"
pass in quick on carp0 inet from 192.168.50.0/24 to any flags S/SA keep state label "USER_RULE: Default LAN - any"
pass in quick on carp1 all flags S/SA keep state label "USER_RULE"Isn't here something wrong?
-
you have this: pass quick proto carp all keep state
It means at least carp packets (vrrp) shouldn't have any restrictions.
you should have the same (almost) dump on vlan1 as you have on WAN for vrrp. -
<wan><if>fxp0</if>
<mtu><ipaddr>192.168.1.201</ipaddr>
<subnet>1</subnet>
[..]I finally found the problem. Simple little configuration mistake, see above. I apologize for the trouble caused.</mtu></wan>
-
N NobleKangaroo referenced this topic on