Get DHCP IP for OPT1 from LAN

famid

Hi, sorry might be a stupid Question but can't figure it out.

I have a standard setup 1x WAN getting IP via DHCP from ISP and 1x LAN doing NAT and serving Private Network IPs to local clients. All working fine.
Now I wanted to add a OPT1(igb0) interface getting its own Interface IP from the LAN DHCP Server, I connected the OPT1 Interface to the same switch as the LAN Interface and activated "IP 4 Config Type = DHCP" on the Interface. Also added FW Rules to pass all IP4 Traffic on LAN and OPT1 but the Interface won't get an IP from the LAN DHCP Server.

System Log says:

dhclient 37991 DHCPDISCOVER on igb0 to 255.255.255.255 port 67 interval 16
dhclient 39213 send_packet: Permission denied

THX for your help

johnpoz

@famid said in Get DHCP IP for OPT1 from LAN:

OPT1(igb0) interface getting its own Interface IP from the LAN DHCP Server

And what would be the point of this? What are you hoping to accomplish?

JKnott

@famid

You can't have the same subnet on 2 different interfaces.

famid

@johnpoz Thank you for your reply. In fact I do have two identical pfSense Boxes and one acts as a (manually updated and manually to be pluged) standby. The idea is to have a dynamically (static entry) assigned Interface on both boxes which is all the time connected to update box2 in case of config changes on box1.

I only have one fiber connection with /32 Address on the Wan side, so I think I cannot use HA CARP...

viragomann

@famid said in Get DHCP IP for OPT1 from LAN:

In fact I do have two identical pfSense Boxes and one acts as a (manually updated and manually to be pluged) standby. The idea is to have a dynamically (static entry) assigned Interface on both boxes which is all the time connected to update box2 in case of config changes on box1.

I think, it's more reliable to set up an automatic config backup, which you can quickly restore on the back box.

I only have one fiber connection with /32 Address on the Wan side, so I think I cannot use HA CARP...

At least it is moer complicated to set up and less comfortable as when you have multiple WAN IPs.

JKnott

@famid said in Get DHCP IP for OPT1 from LAN:

I only have one fiber connection with /32 Address on the Wan side, so I think I cannot use HA CARP...

A /32 means it can't communicate directly with anything. There must be some other address used, unless other than IP addressing is used to reach it. For example, on IPv4, perhaps the MAC address. On IPv6, link local addresses are often used for routing and the WAN address is only used to identify the interface. Anything connecting to it, such as a VPN, has to pass through pfsense, after using the link local address to get there.

famid

@jknott with /32 i meant I only do have one fixed IP from my ISP at the WAN side.
As CARP requires at least 3 IPs (From the docs: A High Availability cluster using CARP needs three IP addresses in each subnet along with a separate unused subnet for the Sync interface) I can't use the HA functionality.

johnpoz

seen many a post with doing it with single IP from ISP, and running a different L3 for the wan interfaces, etc. You can dig around the forums or interwebs for info on doing it that way.

JKnott

@famid said in Get DHCP IP for OPT1 from LAN:

with /32 i meant I only do have one fixed IP from my ISP at the WAN side.

That is not what /32 means. On IPv4, my WAN connection is /23, which allows for up to 510 devices. People often have /24 on the LAN, for 254 devices. The longest mask that will allow 2 devices to communicate directly is a /31, as might be used on a point to point connection.

famid

@johnpoz thx you got my on track again. Found 3 potential solutions

I can use the LOM Boards of the servers to upload the config to Box B if something has changed on Box A
I realized I can use the XML RCP Config Sync without using CARP (to sync the config but still have to plug WAN / LAN manually in case of failure of Box A
Use another Router in front of the pfSense Boxes doing double nat (with CARP but with the drawback of adding another Single Point of Failure)

I guess I will go for 2)

thx anybody for support and clarifications

johnpoz

@jknott said in Get DHCP IP for OPT1 from LAN:

That is not what /32 means

Depends on context.. If I see /32 tells me its a host address, use /32 all the time in firewall rules to limit a rule to that specific IP.

Its a way to make sure its understood that its a single IP and not to use a network, ie assume the default mask used on that network, etc.

Normally you wouldn't call out /32 when just talking about a specific IP, but depending on context of the discussion using /32 is valid to state.

JKnott

@johnpoz said in Get DHCP IP for OPT1 from LAN:

Depends on context.. If I see /32 tells me its a host address, use /32 all the time in firewall rules to limit a rule to that specific IP

He said "with /32 i meant I only do have one fixed IP from my ISP at the WAN side". People normally get a single IPv4 address from their ISP. However, that does not mean they're on a /32 network. In my case, it's a /23. Your host address is correct in that it only provides an address, but you can't communicate directly with it. There is something similar with OSPF router IDs. On IPv6, I have a /128, which is the equivalent of a /32 on IPv4. I don't think the OP was using it for rules, but implying a single address out of whatever the ISP puts out.

Perhaps he should have said he had a single address instead of "I only have one fiber connection with /32 Address on the Wan side".

SteveITS

@johnpoz said in Get DHCP IP for OPT1 from LAN:

seen many a post with doing it with single IP from ISP, and running a different L3 for the wan interfaces

I've done that. When Comcast provides a public IP and their router is "bridged," their default 10.1.10.0/24 subnet still works. So I set up an IP in that subnet on both, and set the public IP as the CARP virtual IP. The reason other WAN addresses are needed are so the routers can connect to the Internet, for example to install updates without forcing a failover.

viragomann

@steveits said in Get DHCP IP for OPT1 from LAN:

The reason other WAN addresses are needed are so the routers can connect to the Internet, for example to install updates without forcing a failover.

If you have only one WAN IP there is a possible workaround with gateway groups to get internet access on the backup node as well.

You can create a gw group on both with the CARP VIP as tier 1 and the respective others LAN IP as tier 2. Then set this gw group as default gw.
You will have to disable XMLRPC sync of static routes settings.

So if the CARP is occupied by the master, the backup node uses the masters LAN for connecting to the internet.
Might be a bit tricky, but should work thus far.