Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No NAT for Backup FW's webUI?

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    2 Posts 2 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      Fr3d
      last edited by

      I've got CARP setup pretty successfully and have just one last thing left to fix: the backup firewall is unable to check for updates or download package lists/files.

      The backup firewall is however able to ping external IPs (8.8.8.8 etc) using the webUI Diagnostics->Ping page, as well as via ssh/console.

      Outbound NAT setup screenshot: http://www.fr3d.org/ss/lando/clipping_58076.png
      (You can see I've tried adding a few extra rules, with no success).

      VIPs:
      WAN: 192.168.1.10 /24 (yes, it's double-NAT'd :( )
      LAN: 10.10.0.1 /24
      WIFI: 172.16.0.1 /24

      FW1:
      WAN: 192.168.1.201 /24
      LAN: 10.10.0.201 /24
      WIFI: 172.16.0.201 /24

      FW2:
      WAN: 192.168.1.202 /24
      LAN: 10.10.0.202 /24
      WIFI: 172.16.0.202 /24

      If I disable CARP on the master - therefore making the backup FW the new master - update checks and package installs work just fine.

      Any ideas?

      Thanks in advance :)

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        generally that's because you're NATing the secondary firewall's Internet traffic to a CARP IP. Not clear from that screenshot which rule would be doing that given I'm not sure what the WAN IP is, but just make sure you're not NATing traffic sourced from either firewall's WAN IP.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.