Dnsmasq - doesn't work for ip4

[GreenMatter]

I've just configured (in 26.1.2_5) HA - CARP VIPs for WAN and all my vlans. I made sure that VIPs have correct netmask (same as respective vlan).
I use Dnsmasq DNS & DHCP as DHCP server (ip4, ip6 in RA mode: slaac and ra-names).
And once I switched over to VIPs I had lost ip4 DHCP connectivity. I verified VIPs netmasks, in dnsmasq there's no any relevant option except selecting interfaces and strict binding - which doesn't help.
When I manually assign in client ip4 address - all works fine, connectivity is flawless even with switching over between master and backup...

Have I missed something, how to fix it??

EDIT:
Both opnsense instances are virtualised - Proxmox VM

[nero355]

If you are running a HA setup then you need KEA DHCP Server : https://docs.opnsense.org/manual/dhcp.html ;)

[GreenMatter]

you need KEA DHCP Server

Thanks, just migrated to dnsmasq a few months ago... I also use wifi enterprise and freeradius.
For test purposes I configured KEA on one vlan (stopped dnsmasq), as per https://docs.opnsense.org/manual/kea.html, have added standby and primary HA peers (firewall rules as well) did synchronisation. KEA receives heartbeat but still nothing - I can't get assigned ip4 address in client.

[GreenMatter]

As far as I can see, even KEA sends dhcp offers from interface address and not VIP. Is it correct?

[Seimus]

Yes that is correct, that's how DHCP works.

You can have the Clients to reach the VIP, but the response for DHCP offer will come from the interface IP and not VIP.
You can only bind the listening interface/IP but not the responding.

I am running two DHCP servers based on DNSmasq on linux servers. They are both active, as DNSmasq doesnt support HA, so I have set on the second one a delay in response. Meaning the first server always is the one respond first.

Regards,
S.

[GreenMatter]

Yes that is correct, that's how DHCP works.

Ok, I understand. But still, once HA (vlans carp vip) is activated, dhcp clients in lan don't receive ip4 address. FW rules have been created automatically...

[Seimus]

You should review your secondary DHCP server then as well live log if you see anything blocked or dropped.

Regards,
S.

[GreenMatter]

The issue shows up once VIPs are set. Even with backup instance completely off, I'm not able to obtain ip4 address. In dhcp logs, I can see offers being sent, maybe auto FW rules are not correct?

[nero355]

For test purposes I configured KEA on one vlan (stopped dnsmasq)

OPNsense does not support a different DHCP Server per Interface so if you want to test then you need to move EVERYTHING to KEA sadly !!