Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting up CARP cluster for LAN and WAN VIPs at the same time

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    15 Posts 5 Posters 6.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      captain kirk
      last edited by

      I'm currently working on a project that would allow remote users and remote store branches to VPN into our corporate network (PPTP for the road warriors and IPsec for the store branches who will be using Netgear's FVS-338 VPN routers), but would like to have them access a VIP on the WAN side.  The users that work in the corporate headquarters on the other hand would also need access to the internet.

      What I'm looking at is configuring the CARP cluster with a WAN vip for the VPN and also a LAN vip for the users working in the headquarters.  Would it be possible to have a cluster of 2 pfSense servers that would serve as a redundant gateway which would provide failover for incoming AND outgoing traffic at the same time?

      1 Reply Last reply Reply Quote 0
      • H
        hoba
        last edited by

        Absolutely. Have a look at http://pfsense.com/mirror.php?section=tutorials/carp/carp-cluster-new.htm .
        Additional to this you need to set your IPSEC failover settings to use the WAN CARP IP (VPN, IPSEC, failover tab). For PPTP you need to add 2 additional rules for the CARP WAN IP to allow protocol GRE and TCP 1723 to it at firewall>rules, wan tab. I have exactly such a setup running.

        1 Reply Last reply Reply Quote 0
        • S
          sullrich
          last edited by

          http://doc.pfsense.org/index.php/Setting_up_CARP_with_pfSense

          1 Reply Last reply Reply Quote 0
          • C
            captain kirk
            last edited by

            Hi!  Thanks so much for your help!  The one thing that I'm stuck on, though, is the DHCP settings.  When testing it out with only one node in the CARP cluster, DHCP would not assign me any IPs.  I've followed the tutorial, but still no go.  Statically assigned IPs with the gateway and dns set to the VIP works fine, though.  Is there something I missed?  Again, thanks for your help!  :D

            1 Reply Last reply Reply Quote 0
            • dotdashD
              dotdash
              last edited by

              Check the logs. I had a similar problem with failover dhcp and it turned out to be because time was out of sync on one of the boxes causing DHCPd to bomb due to the time discrepancy.

              1 Reply Last reply Reply Quote 0
              • S
                sullrich
                last edited by

                Recent snapshots sync the time with ntpdate on bootup.  Please upgrade.

                1 Reply Last reply Reply Quote 0
                • H
                  heiko
                  last edited by

                  Hello,

                  i think i misunderstand something. I have also a carp cluster with 25 ipsec tunnels and all works fine without ipsec. The Master WAN Ip ist 217.6.55.4 , the backup carp ist 217.6.55.5 and the VIP ist 217.6.55.6. On the master i cannot change anything on the tunnel def., because the remote side is setting to 217.6.55.4. In the carp cluster i syncronize IPSEC, so when the master fails, the remote side have a settting to 217.6.55.4, but the backup member is 217.6.55.5. I can set the ipsec failover on the master to the vip 217.6.55.6 but i cannot understand this scenario, because the backup member ist at the WAN 217.6.55.5…..

                  I think, i get a little bit help to understand the settings.... a liitle bit confusing?

                  Grreetings from Germany
                  Heiko

                  1 Reply Last reply Reply Quote 0
                  • S
                    sullrich
                    last edited by

                    #1. Setup your tunnels to use "IP address" and the VIP carp member
                    #2. Visit Vpn, IPSEC, Failover IPSEC, define the VIP ip address
                    #3. Visit the other end of the tunnel, make sure the remote gateway is
                    set as the CARP VIP
                    #4. There is no step 4.  Enjoy your failover IPSEC.

                    1 Reply Last reply Reply Quote 0
                    • H
                      heiko
                      last edited by

                      Hello,

                      it´s all greek to me. Scott, i found this with google, but i understand not which settings are do you mean

                      –> Setup your tunnels to use "IP address" and the VIP carp member

                      Do you mean the tunnel settings my identifier as the ip adress?
                      I have to have lost one's way...., i think

                      Thank you for your help!
                      Heiko

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by

                        IP address = CARP public ip

                        1 Reply Last reply Reply Quote 0
                        • H
                          heiko
                          last edited by

                          Hello Scott,

                          excuse me…

                          do you mean the settings in the conn. of ipsec or other...?

                          i`m stupid

                          Heiko

                          1 Reply Last reply Reply Quote 0
                          • H
                            hoba
                            last edited by

                            vpn>ipsec, failover tab. Set your shared CARP IP there.

                            1 Reply Last reply Reply Quote 0
                            • H
                              heiko
                              last edited by

                              Hallo Hoba,
                              ich schreibs noch einmal auf deutsch, habe wahrscheinlich wirklich nen Brett vorm Kopf. Tut mir leid, aber ich will´s halt verstehen..

                              wenn ich doch zwei wan-adressen und eine vip wan habe, diese  als failover einsetze, die tunnel doch aber auf die wan adresse des masters gemappt sind, wie funktioniert dann ein failover. oder wird in einem Carp Cluster mit eingesetzter VIP als IPSEC failover immer diese in die racoon.conf geschrieben und die eigentliche WAN Adresse des masters vernachlässigt?

                              Vielleicht verstehe ich es ja diese Jahr noch?
                              Gruß
                              Heiko

                              1 Reply Last reply Reply Quote 0
                              • H
                                hoba
                                last edited by

                                Richtig, die im IPSEC failover tab angegebene Adresse wird dann für den lokalen IPSEC Traffic verwendet und kann somit auch vom Slave übernommen werden.

                                1 Reply Last reply Reply Quote 0
                                • H
                                  heiko
                                  last edited by

                                  danke, jetzt habe ich es
                                  gruß
                                  heiko

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.