CARP with DHCP on WAN

[toreamun]

This thread is about exactly the problem I had - running a CARP WAN when the ISP hands you the address over DHCP (mine is a CGNAT fiber link). I ended up solving it as a proper OPNsense plugin rather than a script, in case it's useful to anyone here.

Approach: the scripts in this thread up/down the WAN interface (and juggle MAC spoofing / write_config) on each CARP transition. This plugin does something different - it keeps a dedicated DHCP lease alive for the CARP VIP's virtual MAC (00:00:5e:00:01:<vhid>). Whichever node is MASTER answers on that MAC and holds the lease, so the ISP hands the WAN address to the active node. No interface up/down, no MAC-spoof juggling, no write_config on every event.

Prerequisite: your ISP's DHCP server has to be willing to hand out a lease to the CARP VIP's virtual MAC - i.e. it can serve more than one active address on your WAN (your box already has its own, the VIP needs an additional one). If your ISP binds the line to a single MAC / a single address, this approach won't work. In my case the ISP gives the VIP MAC its own DHCP reservation.

What it gives you over a raw script:
- Native plugin with a GUI (Interfaces -> Virtual IPs DHCP) - no editing PHP/shell
- Signed releases + a one-line verified installer

Install (OPNsense 26.1, as root):

Code Select Expand

fetch -o - https://raw.githubusercontent.com/toreamun/opnsense-plugins/main/install.sh | sh
The installer verifies the release signature against the committed public key before installing.

Repo: https://github.com/toreamun/opnsense-plugins

Full disclosure: my own project, currently v1.0, and tested mainly in my own setup (CGNAT fiber, active/passive OPNsense pair) - not yet widely deployed. Feedback and issues very welcome, happy to answer questions here.

If you give it a try, I'd love to hear how it goes — drop a comment or open an issue on GitHub. If there's enough interest I'm considering submitting it to the official OPNsense plugins repo.