High availability with multiple DHCP IP

[egeback]

Hi

I have just setup a HA Opnsense setup with two virtual instances configured with CARP on internal vlan/interfaces but not on WAN due to DHCP setup. My ISP provides several IP DHCP IPs so each instance has its own IP. Failover works on the interfaces with CARP enabled (internal subnets on VLANs configured in Proxmox) but I have not found a way to trigger failover if WAN goes down. Gateway monitoring works but does not trigger failover (not sure if it should though?). Is there anyway to configure the gateway monitoring, or other function to trigger CARP to trigger and backup node takes over if WAN goes down?

I would like to avoid setting up a separate router and run double NAT if possible. I have seen tutorials but seams to be implemented mainly to solve the issue with when you only have a single DHCP address even if I also recognise that dynamic DNS "issue" is also solved, since the same IP is used on both routers.

[stuartbh]

egeback,

I am trying to plan a similar setup. My ISP provides (non-static, i.e. via DHCP) multiple public IPv4 IPs (at least 3, maybe 5). My interest is if one of the opnsense instance goes down due to hardware or reboot the other takes over. If my WAN DSL modem (a single point of failure) has an issue, then I will accept that.

Can you post what steps you took to get your setup going? I have VLAN capable switches and also use ProxMox.

Stuart

[egeback]

Hi Stuart

To get started I think this excellent video by Jim's Garage is basically started with:
https://www.youtube.com/watch?v=I5n3QXOlxmw&pp=ygUab3Buc2Vuc2UgaGlnaCBhdmFpbGFiaWxpdHk%3D

Another guide from zenarmor that explains the steps in opnsense when proxmox is configured.
https://www.zenarmor.com/docs/network-security-tutorials/how-to-configure-ha-on-opnsense

The setup without CARP/HA on the WAN side works but when the primary firewall goes down my external services goes down since the IP of the WAN changes as the firewall failovers. After this happens either I wait for reboot/fix or I need to trigger a update of the DNS record to my new IP. For my use case this is not a game breaker but could be nice to find a solution without putting another firewall infront of the setup, that is of course possible but goes a bit against HA but on the other hand I only have one incoming internet connection like what you have...

Regards, Marky