High Availability with multiple public IP as IP Alias

[Elia99]

Hello there,
I configured two OPNsense firewalls (23.1.6) in HA mode.

My ISP provides a public subnet X.X.X.X/28, so I have one fixed IP configured on my WAN side, a virtual IP for HA in CARP mode and several public IP Alias on which several services are port forwarded to our internal servers (please see the attached image).

My question is (due to the fact that I'm not able to find anything in the manual about multiple public IP and OPNsense HA): is this High Availability setup correct from a WAN prospective? Have I handled those public IPs correctly? Thanks!

[Monviech]

Yes you use one CARP VIP with the virtual public IP address for the Firewall ( with /28), two IP addresses (/28) on each WAN interfaces of the HA firewalls, and add all additional ones as normal IP Alias ( /32) with the same vhid group as the public CARP VIP.

If you want to use all Public IP addresses in HA you can also set your WAN interfaces to IPv4 none so you can have the whole subnet as 1 Carp + IP Aliases. https://forum.opnsense.org/index.php?topic=34955.msg169303#msg169303

Running that with loads of IP addresses and it works fine. (/26 and an additional /28 net on same HA setup)

[Elia99]

Thank you Moviech for the comprehensive reply!

I just added the same vhid value to IP Alias IP addresses.
For now, I'm satisfied with this setup, thanks again.

[bimbar]

Shouldn't all the aliasas be CARP addresses?

[Patrick M. Hausen]

That would imply separate VHIDs for each one and lots of CARP traffic on that network. Can be quite relevant if you want to "HA" e.g. a complete /26 and up ... like we currently do @Hetzner for one project.