Messages

1

High availability / CARP - change gateway status on switch from master/backup

« on: May 22, 2024, 08:25:09 pm »

I'm setting up a 2 node cluster. What I need to happen is when a given nodes CARP status is BACKUP, then I need to disable a gateway (System - Gateways - Configuration) when viewed in the GUI.  I've been researching this for a few hours and it appears I may need to put a script in /usr/local/etc/rc.syshook.d/carp/ such that when the node enters BACKUP state, it disables a specific gateway and when it enters MASTER state the gateway is enabled again.   I know the concept works, as if I do the work in the GUI then things work as I expect.

In my research I found https://gist.github.com/spali/2da4f23e488219504b2ada12ac59a7dc but that deals with enabling/disabling the WAN interface, which does not accomplish what I'm after.   From a FreeBSD level, I need the default gateway to be changed (from WAN to LAN) thus enabling the backup node to be a client on the LAN and thus able to update, etc.. When the CARP state goes back to MASTER, then the default route needs to be changed again.

Currently I don't have enough knowledge about the internals of opnsense to figure out what the PHP code would have to look like to do what I'm after.   I'm hoping someone who knows more about opnsense can point me in the right direction.

2

22.7 Legacy Series / Re: Connection established via allowed rule, then magically denied via default deny

« on: December 26, 2022, 06:16:06 pm »

Thank you. Hopefully I'll find the routing issue as I investigate and attempt to document what I've created to post here. Except for my physical LAN, everything else is virtual using Proxmox (containers and KVM) and Openvswitch.  I've only noticed the problem between LAN and the VM environment. Some containers are dual homed, but only the OPNsense KVM should be routing packets.

3

22.7 Legacy Series / Connection established via allowed rule, then magically denied via default deny

« on: December 26, 2022, 05:10:59 pm »

OPNsense 22.7.10_2-amd64
FreeBSD 13.1-RELEASE-p5
OpenSSL 1.1.1s 1 Nov 2022

I noticed that establishing an SSH session from one host to another works, then in a small period of time (less than a minute) the connection is stopped, from the perspective of the user using ssh.  In the OPNsense logs I can see the behavior but I don't understand why.  I know this was working a month ago (or so) and now this behavior.  I've rebooted the "firewall machine" (it is a KVM running on a proxmox hypervisor system). 

As you can see in the attached image, when the connection is established the rule is triggered (green entry), then after a period of time the defauly deny rule starts being applied.

I'm hoping someone can point me in the right direction.  This is very annoying and nearly impossible to work around. Any ideas what is wrong?