Hey all,
I'm seeing some weird behavior with my new OPNSense CARP secondary. For background, it's a weird but not a totally unique setup - CARP on the LAN which controls the WAN interface with a hook in `/usr/local/etc/rc.syshook.d/carp` since I only have one WAN IP. My idea being to enable DHCP on the CARP Master and disable on the Backup.
My Master currently holds the WAN IP while the Backup has IPv4 and IPv6 Assignment Type "None", but the Backup is still soliciting DHCP addresses all the while. Same if the interface is not "Enabled" but is left up. Is this expected behavior?
I'm confused here. Can you add more data points?
If WAN is None/None on the backup then no dhclient/dhcp6c should start unless another interface is set to DHCP/DHCPv6.
Cheers,
Franco
Hello Franco,
First off, I need to double check, but it looks like dhcp4/dhclient is no longer running when IPv4 configuration type is None.
The setup is this - the WAN interface `ix1` is set to None/None and I still see messages from dhcp6c "Sending Solicit on ix1" on the Secondary node's `/var/log/system/latest.log`. Even while the interface was totally disabled, I still see these messages in the logs on previous days while this device was the CARP Backup (and thus the interface was disabled) the entire time.
I can verify that these DHCPv6 solicitations are in fact being broadcast on the WAN interface by running packet capture looking for these solicitations on port 546/547. I have some from back on the 14th when I was testing this, but I'll try to get a new capture to re-verify.
The only IPv6 configuration that is still enabled at this time is on the LAN device `ix0`, which is set to "Track Interface", tracking the WAN interface. Could this be causing dhcp6c to still run on the WAN even though it has IPv6 disabled?
----
EDIT: I did more work today to get this setup working properly. It seems like dhcp6c running on the secondary is no longer being seen on the Primary's WAN interface ix1 - perhaps it is running but doesn't actually end up sending any requests out. I'll come back tomorrow and see if the CARP backup with WAN disabled is still sending solicits.