Possible Firewall issue?

mcampbell

If this is considered crossposting, I apologize, I just felt that my post belonged in a couple of different places, and I just wanted to make sure that I had maximum exposure to this conundrum (since the CARP board seems to get significantly fewer visitors). The reference post is located here: http://forum.pfsense.org/index.php/topic,69835.0.html

So I set up a CARP cluster, and started each node up by restoring the same backup to each box and then modifying each one to be a node in the cluster, and adding the appropriate VIPs. So the firewall rules SHOULD be identical. If you reference the Visio diagrams I put up on the other post, you'll see that I have a dual WAN setup in addition to this CARP failover, giving me the following configuration:

BR WAN: 208.x.x.168/29
VIP: 208.x.x.170
pfsense01: 208.x.x.171
pfsense02: 208.x.x.172

CH WAN: 71.x.x.16/29
VIP: 71.x.x.18/29
pfsense01: 71.x.x.19
pfsense02: 71.x.x.20

LAN: 10.1.1.0/23
VIP: 10.1.1.1
pfsense01: 10.1.1.2
pfsense02: 10.1.1.3

The problem is, that I can ping every IP in this lineup, except for 71.x.x.20 externally. And I see this interface is dropping packets with the gateway more than the other one on the same WAN, though I don't know whether the two are related.

Any ideas?

mcampbell

I still haven't been able to resolve this issue. I am at a loss as to how to troubleshoot this issue, so I could really use your help.