CARP failover pfSense and multiple /29's on WAN

[pnieuwkamp]

Hi,

we're getting a routed subnet (/29) on a fiber link, and would like to have a failover cluster using carp. We've bitten the bullet of sacrificing 2 of the IP-addresses (as it's a 2 node cluster), but now some questions arise in case we need more IP addresses.

Let's assume we get 10.0.0.0/29 (yes, I know this is a private range, it's an example ;) )
.0 network
.1 gateway from our provider
.2 pfSense box 1
.3 pfSense box 2
.4 virtual IP
.5 extra ip, to use either with any form of NAT or bypass pfSense
.6 extra ip, to use either with any form of NAT or bypass pfSense
.7 broadcast

Our provider tells us, should those 2 extra IPs prove to be insufficient they can route a new /29 to our virtual IP (10.0.0.4).

Our question then is, what to do with it? We can use OPT1 and AON (to disable the auto-generated NAT entry) and route it there, but if I get the failover-part correctly, this will cost us 3 ip-addresses (OPT1 on pfSense1, OPT1 on pfSense2 and a virtual IP) ?

Can we add all 6 (8 - network - broadcast) as virtual IP's and use any form of NAT to direct traffic to some internal machines? Can we route them to a DMZ and only 'lose' 1 to the pfSense cluster as gateway (like we would if it were a normal non-clustered router)?

[jimp]

The extra subnets should be routed to the WAN CARP VIP (.4 in your case) just like they said. You can either use them directly on internal subnets (and lose some IPs to CARP), or via NAT if you define them as "other" type VIPs or with 1:1 NAT. The key is using the "other" VIP type and not Proxy ARP.

There would be no way to route it, do proper CARP, and only lose one IP.

[pnieuwkamp]

Ok, we'll do that then.

Problem seems to have solved itself somewhat, it appears we're getting a /28 from the start as those 2 free addresses weren't enough anyway.

Thanks for your advice :)