Hi everyone,
I'm migrating from a DrayTek router to a high-availability setup with two OPNsense firewalls. I'm looking for advice on the recommended WAN configuration, particularly regarding CARP and multiple public IP addresses.
My firewall configuration uses multiple public IP addresses for outbound NAT and inbound port forwards.
My main requirement is to keep the same public IP addresses for these services when the active firewall fails over to the secondary node.
Questions
1. Is a CARP VIP on WAN necessary to achieve reliable HA when outbound NAT and inbound port forwards must continue using the same public IP addresses after failover?
2. What would happen if I configured a separate WAN IP address on each OPNsense node but kept CARP only on the internal interfaces? Could the secondary node take over the internal VIPs and continue operating through its own WAN connection? What limitations should I expect regarding existing connections, outbound NAT and inbound port forwards?
3. For additional public IP addresses used by specific NAT rules, is it recommended to configure them as IP Alias VIPs associated with CARP, or is there another preferred approach?
4. Can the same public IP Alias be configured independently on both nodes without CARP, assuming that only one node is active at a time? Or could this cause ARP conflicts or other issues?
5. If the ISP routes an additional public subnet to the firewalls, would routing those addresses through the active node be preferable to configuring multiple CARP VIPs?
My goal is to maintain the same public IP addresses for inbound services and outbound NAT after failover, while keeping the configuration as simple and reliable as possible.
I'd appreciate advice on the recommended architecture and any caveats I should consider.
Thanks in advance!
Hello,
1. Yes
2. Not recommended, 3 public IP addresses in the same subnet are necessary for the best practice configuration
3. You create one CARP VIP for your "primary" public IP, and put additional ones as virtual IPs into the same VHID group
4. The vhid group makes the virtual IPs move at the same time as the CARP VIP, so its save to have them on both nodes
5. You can add more virtual IPs or CARP vips also from other subnets without issue
Read all of this for additional info:
https://docs.opnsense.org/manual/hacarp.html
https://docs.opnsense.org/manual/how-tos/carp.html
Quote from: jarb638 on Today at 01:50:26 PM2. What would happen if I configured a separate WAN IP address on each OPNsense node but kept CARP only on the internal interfaces?
So WAN IP of node A would only be available if A has the master role and the WAN IP of B would only be available if B is master. I think, that's not what you want at all.
Quote from: jarb638 on Today at 01:50:26 PMCould the secondary node take over the internal VIPs and continue operating through its own WAN connection?
Yes, but your WAN IP changes then. This might not be desired.
What's the goal of this idea?