firewall question about carp with vlans



  • I'm reposting my question here, because in the carp-forum I find no answers, and I think it's also firewall related :-)

    Our setup: 2 pfsense boxes with carp (working just fine for years)
    Now, I'm testing with VLANs: I defined vlan 11 on the LAN interface: 10.11.1.2 (master), 10.11.1.3 (backup), 10.11.1.1 (carp virtual ip)
    In the firewall rules, under the VLAN11 tab, I have no rules at all.
    On a client computer, which is on a vlan 11 switchport, I try a couple of pings:

    ping 10.11.1.1 -> no reply
    ping 10.11.1.2 -> no reply
    ping 10.11.1.3 -> reply

    in the firewall logging, I see that the ping to 10.11.1.2 is blocked indeed. When I create a rule to allow all traffic from vlan 11 to everywhere, all pings work. When I look under diagnostics -> states, I only see states for .1 and .2, not for .3.

    My conclusion: traffic for .1 and .2 (the master) is handled by the firewall, traffic for .3 (the backup) is not.

    I'm sure there is a perfectly good explanation, but I really don't see it… is there anyone who can explain it to me?


Log in to reply