Messages

1

High availability / Re: High availability with multiple DHCP IP

« on: October 17, 2024, 11:13:05 am »

Hi Stuart

To get started I think this excellent video by Jim's Garage is basically started with:
https://www.youtube.com/watch?v=I5n3QXOlxmw&pp=ygUab3Buc2Vuc2UgaGlnaCBhdmFpbGFiaWxpdHk%3D

Another guide from zenarmor that explains the steps in opnsense when proxmox is configured.
https://www.zenarmor.com/docs/network-security-tutorials/how-to-configure-ha-on-opnsense

The setup without CARP/HA on the WAN side works but when the primary firewall goes down my external services goes down since the IP of the WAN changes as the firewall failovers. After this happens either I wait for reboot/fix or I need to trigger a update of the DNS record to my new IP. For my use case this is not a game breaker but could be nice to find a solution without putting another firewall infront of the setup, that is of course possible but goes a bit against HA but on the other hand I only have one incoming internet connection like what you have...

Regards, Marky

2

High availability / High availability with multiple DHCP IP

« on: May 28, 2024, 08:16:18 pm »

Hi

I have just setup a HA Opnsense setup with two virtual instances configured with CARP on internal vlan/interfaces but not on WAN due to DHCP setup. My ISP provides several IP DHCP IPs so each instance has its own IP. Failover works on the interfaces with CARP enabled (internal subnets on VLANs configured in Proxmox) but I have not found a way to trigger failover if WAN goes down. Gateway monitoring works but does not trigger failover (not sure if it should though?). Is there anyway to configure the gateway monitoring, or other function to trigger CARP to trigger and backup node takes over if WAN goes down?

I would like to avoid setting up a separate router and run double NAT if possible. I have seen tutorials but seams to be implemented mainly to solve the issue with when you only have a single DHCP address even if I also recognise that dynamic DNS "issue" is also solved, since the same IP is used on both routers.