DHCP using virtual IP with CARP configuration does not work!



  • Hi all!!!

    I set up CARP cluster with load balancing using tutorial ftp://reflection.ncsa.uiuc.edu/pub/pfSense/tutorials/carp/carp-cluster-new.htm.

    Tutorial mentions that it is possible to set up DHCP server using virtual IP, "as DNS and/or gateway".

    Does it realy work in pfSense 1.2?

    I tried to set up mine with no success. Regular DHCP server without virtual IP works fine on both pfSense boxes.

    Is there any work around for setting up CARP cluster and pointing it to one universal gateway without using DHCP with virtual IP as gateway? -dual gateway option in windows works but it is funky!

    Please help.

    Thanks.



  • It works. You have something setu incorrectly if it doesn't. Provide some more details please (IPs, VIPs, DHCP-Server settings,…).



  • So I am doing it on LAN tab of DHCP server.
    My virtual IP 172.16.24.3. I added it through firewall>Virtual ip tab as other (tutorial does not mention it). Same result.

    1st CARP

    subnet 172.16.24.0
    subnet mask 255.255.255.0
    Range 172..16.24.100-200
    Wins
    DNS 172.16.24.3 (virtual ip)
    gateway 172.16.24.3 (virtual ip)
    default lease time
    Maximum Lease time
    Failover Peer IP 172.16.24.2(2-d fail over machine ip LAN adress)

    2st CARP
    subnet 172.16.24.0
    subnet mask 255.255.255.0
    Range 172..16.24.100-200
    Wins
    DNS 172.16.24.3 (virtual ip)
    gateway 172.16.24.3 (virtual ip)
    default lease time
    Maximum Lease time
    Failover Peer IP 172.16.24.1(1st fail over machine ip LAN adress)



  • VIP type Other? It has to be a shared CARP VIP.



  • Thanks Hoba for advise.

    You are the MAN:)!

    Yep, It works now, but I am slightly confused.

    If I use for DNS settings on DHCP server set up tab: 4.2.2.1- Public DNS it works fine,
    but when I do DNS: 172.16.24.3 (virtual ip) it does not.

    I do have DNS servers typed in on "General Setup" page, and Allow DNS server list to be overriden by DHCP/PPP on WAN - unchecked.

    I also noticed when I renewing or reacquiring my network connection it always grabs DHCP server from Secondary CARP machine instead of having it from Primary one. Though when Secondary machine is down it grabs it from primary and vise versa. Is this correct pfSense behavior?

    Thanks again!



  • The pfSens itself need dns servers set at system>general to be able to do lookups. As your WAN is not DHCP (I guess as CARP won't work with DHCP wans) enter them manually there. If you want the pfSense to be the dns for your clients you have to enable the dnsforwarder at services>dns forwarder (which will use the assigned dns servers from system>general). Also make sure you do allow tcp/udp on port 53 to the CARP VIP for the clients (not sure if you have a restricted ruleset for your clients).

    Regarding the DHCP-Server you have some odd behaviour here. Are you sure you have entered the failover peer IP correctly and the master/backup state of your CARP is correct?



  • DCHP fail over peer ip are Correct. Secondary box is pointing to primary IP 172.16.24.1 and primary to 172.16.24.1. Also i checked states Status> CARP>  on secondary machine it shows backup and primary shows Master on all virtual IP.

    I also noticed that not all computes on the network are using secondary as default DHCP server. There are couple that use primary box as DHCP server. Could it possibly be that the root of the problem in dhcp lease times? I went to DHCP leases and it looks like leases table are inconsistent one with each other?

    Overall DHCP server with fail over works though, do you think it is safe to use it the way it is now?

    Thanks.



  • @V-man:

    DCHP fail over peer ip are Correct. Secondary box is pointing to primary IP 172.16.24.1 and primary to 172.16.24.1. …

    Is that a typo? That the master points at itself?



  • Oh, I am sorry! This is a typo it points 172.16.24.2 -Primary points to secondary.



  • Do you have a restrictive ruleset at the interfaces where the dhcp servers are talking to each other that could block communication between them in some way?



  • I only have rules on LAN that are mentioned in the tutorial to set up load balancing!!! http://doc.pfsense.org/index.php/MultiWanVersion1.2

    Firewall: Rules > LAN
    Proto Source Port Destination      Port  Gateway
    *      LAN net *    WAN2 net        *  172.16.32.1            -DMZ2
    *      LAN net *    172.16.34.0/24 *  45.64…..                -DMZ1
    *      LAN net *      *                  *  Load Balancing          -Load Balance



  • I wonder if that causes the dhcp server communication get redirected to the loadbalancing gateways directly. Can you just for testing change the an to any rule to use the default gateway and see if this makes a difference? If yes, we have to add some special rules but that's the easiest test for now.



  • Here is what I found out…

    Yesterday night and I am 100% sure of that, DHCP server was pointing to the CARP BOX2.
    This morning I ran ipconfig /all and it was pointing to CARP BOX1, then I disabled and enabled network connection to renew DHCP and it was  pointing to BOX2 again. After reading your post I disabled all rules except the one with LOAD BALANCER and changed it to default gateway.

    I renewed connection and got routed to BOX1 DHCP server. Then I connected another PC to the network and got routed to DHCP BOX1.
    I thought that your solution worked out. I went back to my PC renewed connection and got back on DHCP BOX2. I guess it was not enough for me, so I used another nic in my pc. I unplagued the cable from old nic into the new one and got DHCP BOX1 right away. Renewed connection and still DHCP BOX1, reverted rules to original ones and still DHCP BOX1. It does not matter now how many times I renew connection I still get BOX1.

    For the moment I thought that it should work now. I went back to PC that I just connected to network. It was sitting on DHCP BOX1. I renewed connections and it went to DHCP BOX2.

    I am guessing that this is not the firewall problem!


Locked