Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Carp: ip-aliases in different subnet ignored

    Scheduled Pinned Locked Moved 2.1 Snapshot Feedback and Problems - RETIRED
    3 Posts 2 Posters 2.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      casper4242
      last edited by

      I'm trying to replace some outdated F5 load balancers with haproxy.  About the only show stopper at the
      moment is the routing setup. Currently, we route the IP addresses of the virtual servers to a VIP on the F5. These
      are all /32 routes, and are thus bound to not be in the same network as the connecting LAN. From a routing
      perspective, I see no problem with such a setup:

      lan:  {pfsense1} – {vip} -- {pfsense2}

      ifconfig {vip} alias {vsvip1}/32
      ifconfig {vip} alias {vsvip2}/32
      ...

      on the upstreams routers:
      ip route {vsvip1} 255.255.255.255 {vip}
      ip route {vsvip2} 255.255.255.255 {vip}

      the {vip} MAC should change between {pfsense1} and {pfsense2} as needed, thus causing the static route
      above to also change between the two firewalls. Still, when i try to enter the ip alias to the vip, the GUI accepts
      the entry, but I can't find it configured anywhere on an interface afterwards. It looks like the entry is silently
      ignored. When I manually go into the shell and do

      ifconfig opt10_vip8

      I don't see any extra address except the carp IP. If I then do:

      ifconfig opt10_vip8 alias {vsvip1}/32

      the system accepts the address just fine.

      this is with 2.1 snapshot of yesterday, July 28. Is there a good reason for this weird behavior?

      Cheers,
      Markus

      UPDATE: interestingly, things work if I make the IP-Alias a child of Loopback...

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        If you are using IPs routed to you, then Loopback IP aliases are preferred.

        You only need IP aliases on a WAN interface if that subnet is using Layer 2 on WAN to reach a "gateway" on WAN inside of their subnet.

        Route all of the IPs to your external CARP VIP, use IP alias on localhost, and it works fine.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • C
          casper4242
          last edited by

          Seems I have to get used to being able to work with the Loopback interface in pfsense, glad to hear this is now fully supported. Thanks!

          And by the way: thanks for a great job with the conversion of old configurations. I recently migrated two old pfsense 1.x to 2.1
          without a hitch!

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.