Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CARP secondary unable to reach gateway

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    4 Posts 2 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jwelter99
      last edited by

      Hi everyone,

      I have what appears to be an IPv6 issue.

      Background:

      Two identical pfsense boxes running in a HA pair.

      One can ping the WAN DG, the other can not.  Both can be accessed via the WAN, just that one can't access out the WAN.

      The only differences I can find between the two is the results of an ifconfig:

      Working unit:

      
      em5: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
      	options=209b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_magic>ether 00:30:48:8d:d6:5f
      	inet xx.yy.zz.213 netmask 0xfffffff0 broadcast xx.yy.zz.223
      	inet6 fe80::230:48ff:fe8d:d65f%em5 prefixlen 64 scopeid 0x6 
      	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
      	status: active</full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_magic></up,broadcast,running,promisc,simplex,multicast> 
      

      Broken unit:

      
      em5: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
      	options=209b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_magic>ether 00:30:48:8d:d4:f7
      	inet6 fe80::230:48ff:fe8d:d4f7%em5 prefixlen 64 scopeid 0x6 
      	inet xx.yy.zz.214 netmask 0xfffffff0 broadcast xx.yy.zz.223
      	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
      	status: active</full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_magic></up,broadcast,running,promisc,simplex,multicast> 
      

      The broken one lists the ipv6 IP first and I am wondering if that is causing the issue.  Not sure how to over-ride that?  IPv6 support is disabled in the advanced options.

      Any suggestions?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        That wouldn't have anything to do with it. Especially if you have IPv6 disabled.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • J
          jwelter99
          last edited by

          @jimp:

          That wouldn't have anything to do with it. Especially if you have IPv6 disabled.

          Ok, I am running on hunches here as it's the ONLY thing different except the ip's (obviously).  The problematic unit can't access the packages repository either, it's any firewall initiated traffic to the WAN doesnt make it but from WAN->FW is fine.

          Thanks.

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            If it can't reach it's gateway then it can't get out beyond. Usual things to look for there are to make sure that there are no conflicting IPs, that the switch connecting all three devices (ISP router, carp master, carp slave) is working properly, make sure the subnet mask matches properly (is it really a /28? what's the ISP router set to?), and so on.

            Things like that usually boil down to a conflict of some kind, or a layer 1/2 issue.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.