<![CDATA[CARP traffic not seen in firewall logs/bypassing firewall rules]]>I have three CARP VIPs setup with two nodes. I have a very minimal set of rules. The whole High availability setup seems to be working correctly, One master, one backup. The backup takes over when at least one link fails on the master. Configuration synchronizes correctly. Etc.

The question I have is about the states being created for the CARP VIPs and the firewall rules.

I've noticed that firewall states are being created for the three CARP VIPs. Since states exist, firewall rules are bypassed, CARP traffic is allowed and no log entries are being shown.

Is this normal behaviour?

Are there implicit firewall rules allowing CARP traffic?

Thanks,

]]>https://forum.netgate.com/topic/77456/carp-traffic-not-seen-in-firewall-logs-bypassing-firewall-rulesRSS for NodeFri, 17 Jul 2026 09:18:31 GMTTue, 30 Dec 2014 00:32:29 GMT60<![CDATA[Reply to CARP traffic not seen in firewall logs/bypassing firewall rules on Wed, 31 Dec 2014 17:11:54 GMT]]>yes, that's what I meant.

Thanks,

]]>https://forum.netgate.com/post/504219https://forum.netgate.com/post/504219Wed, 31 Dec 2014 17:11:54 GMT<![CDATA[Reply to CARP traffic not seen in firewall logs/bypassing firewall rules on Tue, 30 Dec 2014 14:40:11 GMT]]>It depends on exactly what you mean by "CARP traffic".

If you mean the actual multicast heartbeats sent by CARP to announce the VIPs to the segment, then yes they have rules set to allow the traffic automatically to skip NAT and other things that could break CARP.

: grep -i carp /tmp/rules.debug
no nat proto carp
no rdr proto carp
block in log quick proto carp from (self) to any
pass quick proto carp
]]>https://forum.netgate.com/post/503979https://forum.netgate.com/post/503979Tue, 30 Dec 2014 14:40:11 GMT