Relayd (load balancer) on the same interface

pfcomm

I'm trying to set up a higly available IP to load balance between two servers on the LAN interface, with clients also connecting form the LAN inteface.

I can do so when the traffic "flows" trough the pfsense firewall (i.e. incoming IP is on another interface than the servers), but when I set up all on the same LAN interface, I cannot connect to the tcp port which is running the service.

So….

This works:

External Client –--> relayd ----> internal servers

And this does not (in and out on the same interface):

relayd <---- internal client
----> internal server(s)

Any ideas on why and how to fix it ?

thank you.

jimp

In order for that to work you'll need outbound NAT on the LAN to make the traffic appear to originate from the firewall.

You lose the client source IP in the process but otherwise the connections won't work.

It's always best to put the servers on a different subnet away from the clients where possible.

pfcomm

Thanks for pointing this out. I had seen the syn-ack packet coming directly to the client and the RST packet send by the client because of the wrong IP… but did not think to modify the packets with the outbound nat.

Surely works now...

To me the loss of the source IP is not a problem (until I'll need to debug stuff), as it's from a pool of my own servers, and the load balancer is required to prevent a single point of failure :)

Thanks again :)