Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    CARP failover pfSense and multiple /29's on WAN

    Routing and Multi WAN
    2
    3
    2248
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pnieuwkamp last edited by

      Hi,

      we're getting a routed subnet (/29) on a fiber link, and would like to have a failover cluster using carp. We've bitten the bullet of sacrificing 2 of the IP-addresses (as it's a 2 node cluster), but now some questions arise in case we need more IP addresses.

      Let's assume we get 10.0.0.0/29 (yes, I know this is a private range, it's an example ;) )
      .0 network
      .1 gateway from our provider
      .2 pfSense box 1
      .3 pfSense box 2
      .4 virtual IP
      .5 extra ip, to use either with any form of NAT or bypass pfSense
      .6 extra ip, to use either with any form of NAT or bypass pfSense
      .7 broadcast

      Our provider tells us, should those 2 extra IPs prove to be insufficient they can route a new /29 to our virtual IP (10.0.0.4).

      Our question then is, what to do with it? We can use OPT1 and AON (to disable the auto-generated NAT entry) and route it there, but if I get the failover-part correctly, this will cost us 3 ip-addresses (OPT1 on pfSense1, OPT1 on pfSense2 and a virtual IP) ?

      Can we add all 6 (8 - network - broadcast) as virtual IP's and use any form of NAT to direct traffic to some internal machines? Can we route them to a DMZ and only 'lose' 1 to the pfSense cluster as gateway (like we would if it were a normal non-clustered router)?

      1 Reply Last reply Reply Quote 0
      • jimp
        jimp Rebel Alliance Developer Netgate last edited by

        The extra subnets should be routed to the WAN CARP VIP (.4 in your case) just like they said. You can either use them directly on internal subnets (and lose some IPs to CARP), or via NAT if you define them as "other" type VIPs or with 1:1 NAT. The key is using the "other" VIP type and not Proxy ARP.

        There would be no way to route it, do proper CARP, and only lose one IP.

        1 Reply Last reply Reply Quote 0
        • P
          pnieuwkamp last edited by

          Ok, we'll do that then.

          Problem seems to have solved itself somewhat, it appears we're getting a /28 from the start as those 2 free addresses weren't enough anyway.

          Thanks for your advice :)

          1 Reply Last reply Reply Quote 0
          • First post
            Last post

          Products

          • Platform Overview
          • TNSR
          • pfSense
          • Appliances

          Services

          • Training
          • Professional Services

          Support

          • Subscription Plans
          • Contact Support
          • Product Lifecycle
          • Documentation

          News

          • Media Coverage
          • Press
          • Events

          Resources

          • Blog
          • FAQ
          • Find a Partner
          • Resource Library
          • Security Information

          Company

          • About Us
          • Careers
          • Partners
          • Contact Us
          • Legal
          Our Mission

          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

          Subscribe to our Newsletter

          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

          © 2021 Rubicon Communications, LLC | Privacy Policy