pfSense HA with CARP using only one public IPv4 address
-
Hello,
I am currently testing a High Availability setup with two physical x86 firewalls running pfSense CE 2.8.1.
The HA configuration is currently working correctly on the LAN side:
Primary LAN: 192.168.10.2/24
Secondary LAN: 192.168.10.3/24
LAN CARP VIP: 192.168.10.1/24
Dedicated SYNC network between both firewalls
pfsync enabled and working
XML-RPC configuration synchronization enabled and working
Primary is MASTER and Secondary is BACKUP for the LAN CARP VIPMy question concerns the WAN architecture.
We only have one public IPv4 address provided by our ISP.
The expected behavior is:
Internal clients must always access the Internet using the same public IPv4 address.
Incoming connections must continue to use PUBLIC_IP:PORT.
If the Primary firewall fails, the Secondary should automatically take over without changing the public IPv4 address used by clients or external services.According to the pfSense HA documentation, the recommended WAN configuration uses three addresses in the same WAN subnet:
one WAN address for the Primary node;
one WAN address for the Secondary node;
one CARP VIP shared between them.However, in our case we only have one public IPv4 address available.
I understand that one possible design would be to keep the public IPv4 address on an upstream router performing NAT, and create a private WAN transit network such as:
Upstream router: 192.168.50.1
Primary WAN: 192.168.50.2
Secondary WAN: 192.168.50.3
CARP WAN VIP: 192.168.50.4The upstream router would then NAT the single public IPv4 address to/from the CARP VIP.
I also saw in the documentation that Single Address CARP is technically possible, but is generally not recommended on WAN interfaces because the backup node would not have independent WAN connectivity.
My questions are:
Is there any other supported or recommended architecture allowing two pfSense firewalls in HA with only one public IPv4 address, without requiring NAT on an upstream router?
Is Single Address CARP suitable for this use case, and if so, what would be the correct WAN interface configuration on both nodes?
Can the same public IPv4 address be used directly as a CARP VIP while leaving the physical WAN interfaces without individual IPv4 addresses?
Are there specific limitations regarding gateway monitoring, outbound NAT, inbound NAT/port forwarding, updates or package installation in this configuration?
Is there another mechanism in pfSense to make a single WAN address fail over between two nodes without requiring three addresses in the WAN subnet?The goal is mainly to validate the correct HA architecture before deploying this configuration in a production environment.
Thank you for your help.
-
@Nimizu said in pfSense HA with CARP using only one public IPv4 address:
architecture allowing two pfSense firewalls in HA with only one public IPv4 address, without requiring NAT on an upstream router?
Yes, maybe. The docs briefly mention leaving router2 WAN essentially disconnected, and why that's an issue.
Around here, Comcast business cable routers provide NAT even if a static IPv4 is configured. So it is possible to configure:
router1 WAN: 10.1.10.101, gateway 10.1.10.1
router2 WAN: 10.1.10.102, gateway 10.1.10.1
shared WAN: public IPIf you are just testing though you can set it all up with your 192.168.50.1/24 subnet and change the WAN IPs later...?
-
Thanks for your answer, that makes sense.
For testing, I’ll probably use a private WAN subnet like 192.168.50.0/24 as you suggested.My main question is for the final setup: if I only have one public IPv4 address and the ISP router is in bridge mode, is there any recommended way to use that single public IP with HA while keeping WAN connectivity on both nodes?
Or would the only practical options be either:
using NAT on the ISP router with private WAN IPs + a CARP VIP, or
getting additional public IPs for both nodes + the CARP VIP? -
@Nimizu In bridge mode does the ISP router not also provide NAT? If not then you could try using 3 private IPs, and set the shared IP as the DMZ in the ISP router so all traffic is forwarded to it.
It should also work in bridge mode if you had 3 public IPs.
Basically, you want to get router1 working, get router2 working (you can test from Diagnostics>Ping), then add the shared WAN IP and shared LAN IP (gateway).
-
Thanks, understood.
So just to confirm: if my ISP device stays in bridge mode and I only have one public IPv4 address, there is no standard/recommended HA setup where both pfSense nodes have independent WAN connectivity.For the standard HA design, I would either need three usable public IPs on the bridged WAN subnet, or keep an upstream router/NAT and use three private IPs for the two WAN interfaces and the CARP VIP.
Is that correct?
-
@Nimizu said in pfSense HA with CARP using only one public IPv4 address:
if my ISP device stays in bridge mode and I only have one public IPv4 address, there is no standard/recommended HA setup where both pfSense nodes have independent WAN connectivity.
I have done this on Comcast with only one public IP (actually it was multiple, but they needed all of them shared/CARP so they didn't have 3 available) because the default 10.1.10.0/24 network still works if using a static public IP. If router2 doesn't have connectivity you would need to do the process in the docs, basically, fail over to router2 so it has Internet, then update router2. (as opposed to the normal, no-downtime way: update router2, fail over to router2, update router1, fail back)
I expect Comcast keeps the default subnet working so they can say "plug a laptop into our router" and verify the customer's router is the problem. This is probably not a universal behavior among ISPs.
@Nimizu said in pfSense HA with CARP using only one public IPv4 address:
either need three usable public IPs on the bridged WAN subnet, or keep an upstream router/NAT and use three private IPs for the two WAN interfaces and the CARP VIP.
Those methods will work yes.
Privacy Policy · Cookie Policy