pfSense cluster with a routing /30 and a /28 subnet (both public)
-
I have read through endless thread about the topic, but none seem to address my specific issue.
I have a working pfSense cluster. I have a working internet connection. I have my /29 subnet working. The /29 is setups as CARP VIP's except for the 2 dedicated ip's I have assigned or the firewalls.
The problem is the /30 -routing network. The /30 ip is setup as an alias ip on the shared CARP VIP that is used for outbound NAT. Setup in this way, means that only one of the firewalls at a time has internet connectivity. The passive one does not have a route to the internet.
So, what is the right way to do this when
a) there is a routing network /30 with one public ip
b) there is another network with public ip's assigned to the firewalls and router thru the /30 by the ISP
c) I wan to have network connectivity on BOTH firewalls, not only the currently active master. -
@tsmalmbe Your routers each need a public IP plus the CARP/shared IP. So the /29 could be used for that with another IP on the upstream router as your gateway.
Technically it can be done with private IPs using NAT, with one shared IP. I’ve done that with Comcast since their router does NAT in bridge mode.
-
This is NOT the answer. This is the answer with ONE public ip, NOT for a situation with a PUBLIC /30 routing network and a PUBLIC /28 network routed. Maybe I was unclear, so I will try again.
I have a /28 PUBLIC network with PUBLIC ip's assigned to both the firewalls. of course the CARP VIP is public as well. This is ROUTED thru a ROUTING network by my ISP - that network is a /30 and thus contains only ONE ip-address.
So now I repeat the question:
What is the right way to do this when
a) there is a routing network /30 with one public ip
b) there is another network with public ip's assigned to the firewalls and routed thru the /30 by the ISP
c) I want to have network connectivity on BOTH firewalls, not only the currently active master.Things I have tried:
- I make the /30 assigned single address as an alias ip to the PUBLIC CARP of the /28. This gives me a working /28 but only internet on ONE firewall
- I make the /30 assigned single address as an alias ip on the WAN interface. This gives me internet on both firewalls but the /28 block stops working
- I make the /30 assigned single address a proxy ARP on either or both of the firewalls - confusing results overall
I also somewhat struggle to understand the results of my tests above.
-
@tsmalmbe So the public IPs on WAN have no Internet access? That just seems a bit odd and hence my misunderstanding. In that situation if only the one IP has Internet, then there’s not a solution here. You’d have to enter maintenance mode on the primary to move the IP, to update the backup.
Otherwise aliases can work fine if aliased to/on the shared IP, and the ISP/data center routes traffic to the shared IP.