"
Hi everyone,
I'm migrating from a DrayTek router to a high-availability setup with two OPNsense firewalls. I'm looking for advice on the recommended WAN configuration, particularly regarding CARP and multiple public IP addresses.
My firewall configuration uses multiple public IP addresses for outbound NAT and inbound port forwards.
My main requirement is to keep the same public IP addresses for these services when the active firewall fails over to the secondary node.
Questions
1. Is a CARP VIP on WAN necessary to achieve reliable HA when outbound NAT and inbound port forwards must continue using the same public IP addresses after failover?
2. What would happen if I configured a separate WAN IP address on each OPNsense node but kept CARP only on the internal interfaces? Could the secondary node take over the internal VIPs and continue operating through its own WAN connection? What limitations should I expect regarding existing connections, outbound NAT and inbound port forwards?
3. For additional public IP addresses used by specific NAT rules, is it recommended to configure them as IP Alias VIPs associated with CARP, or is there another preferred approach?
4. Can the same public IP Alias be configured independently on both nodes without CARP, assuming that only one node is active at a time? Or could this cause ARP conflicts or other issues?
5. If the ISP routes an additional public subnet to the firewalls, would routing those addresses through the active node be preferable to configuring multiple CARP VIPs?
My goal is to maintain the same public IP addresses for inbound services and outbound NAT after failover, while keeping the configuration as simple and reliable as possible.
I'd appreciate advice on the recommended architecture and any caveats I should consider.
Thanks in advance!
I'm migrating from a DrayTek router to a high-availability setup with two OPNsense firewalls. I'm looking for advice on the recommended WAN configuration, particularly regarding CARP and multiple public IP addresses.
My firewall configuration uses multiple public IP addresses for outbound NAT and inbound port forwards.
My main requirement is to keep the same public IP addresses for these services when the active firewall fails over to the secondary node.
Questions
1. Is a CARP VIP on WAN necessary to achieve reliable HA when outbound NAT and inbound port forwards must continue using the same public IP addresses after failover?
2. What would happen if I configured a separate WAN IP address on each OPNsense node but kept CARP only on the internal interfaces? Could the secondary node take over the internal VIPs and continue operating through its own WAN connection? What limitations should I expect regarding existing connections, outbound NAT and inbound port forwards?
3. For additional public IP addresses used by specific NAT rules, is it recommended to configure them as IP Alias VIPs associated with CARP, or is there another preferred approach?
4. Can the same public IP Alias be configured independently on both nodes without CARP, assuming that only one node is active at a time? Or could this cause ARP conflicts or other issues?
5. If the ISP routes an additional public subnet to the firewalls, would routing those addresses through the active node be preferable to configuring multiple CARP VIPs?
My goal is to maintain the same public IP addresses for inbound services and outbound NAT after failover, while keeping the configuration as simple and reliable as possible.
I'd appreciate advice on the recommended architecture and any caveats I should consider.
Thanks in advance!
