Hello,
So far everything is working fine BUT:
Only 1 firewall is used as a gateway for both machines and the other one acts like a passive backup.
To improve I'm thinking about using OPNsense with CARP for HA and automatic failover without changes on all servers and VMs. OPNsense is running as Hyper-V guests on each host already but without CARP.
Here is a network diagram (thanks a lot to https://textik.com ):
+----------+
| INTERNET |
+----------+
|
+-----|----+
+----------------- Gateway -----------------+
| +----------+ |
| |
+-----------------+ +-----------------+
| NIC1: Public IP | | NIC1: Public IP |
+-----------------+ +-----------------+
+-----------------------------+ +----------------------------+
Hyper-V Host1 | | | | Hyper-V Host2
| +---------+ | | +---------+ |
| | VM: FW1 | | | | VM: FW2 | |
| +---------+ | | +---------+ |
| | | | | |
| +----|----+ | | +----|----+ |
| | VM: DB | | | | VM: TS | |
| +---------+ | | +---------+ |
| | | | | |
| | | | | |
+-------------|---------------+ +---------|------------------+
+-----------+ +-----------+
| NIC2: LAN +--------------------- NIC2: LAN |
+-----------+ +-----------+The main idea is to have all VMs and also the host behind a firewall. Access will be possible only via VPN -> WireGuard is up and running already. That is working already but only with 1 firewall which is not ideal.
My questions are now:
- How to change the network to implement CARP (if that's possible)?
- Do I need a 3rd public IP for the new "virtual WAN gateway" or can I use one or both of the 2 available already?
- Does it make sense to somehow use both public IPs for the 2 firewalls?
- I think the 2 virtual IPs for WAN + LAN can be configured on top of the 2 existing NICs, can't they?
- Is XMLRPC needed to sync the configuration?
- Seems that WireGuard doesn't work with CARP? Any recommendation/solution?
Reference: https://forum.opnsense.org/index.php?topic=14269.0
The provider is using MAC address filtering to allow access to the gateway but I managed that successfully with MAC address spoofing already.