0

Ok, this might sound a little confusing but I will try to describe it nonetheless: I have in my LAN two routers that are running a HA-CARP setup connected to two DSL WAN lines. The CARP works as intended: When the one DSL modem stops working, the network traffic is automatically routed over the second, backup line and I appear in the internet with the IP-number of the second modem.

Default gateway for internet access via main DSL is 192.168.32.1 which is the virtual IP for both pfsenses connected via DSL modem on 192.168.13.1 to the internet. A backup connection goes to the second DSL modem on 192.168.23.1.

In case of an outage, CARP manages to route all internet traffic over .23.1 I have tested both, pulling the pfsense router out and disconnecting the DSL modems.

However I somehow can not reach .23.1 from within the LAN in normal operation, means, when .13.1 is serving internet access. Traceroute packets always go over .13.1 into the internet but the router knows, that .23.0/24 is accessed via it's interface for the backup line and on the router I can ping .23.1 just not from the LAN.

Routing table on the router

Internet:
Destination        Gateway            Flags     Netif Expire
default            192.168.13.1       UGS         re0
127.0.0.1          link#4             UH          lo0
192.168.13.0/24    link#1             U           re0 <- Default WAN
192.168.13.2       link#1             UHS         lo0 <- vIP for CARP
192.168.13.3       link#1             UHS         lo0 <- Real IP
192.168.23.0/24    link#2             U           re1 <- Backup WAN
192.168.23.2       link#2             UHS         lo0 <- vIP for CARP
192.168.23.3       link#2             UHS         lo0 <- Real IP
192.168.32.0/24    link#3             U           re2 <- LAN
192.168.32.1       link#3             UHS         lo0 <- vIP for CARP
192.168.32.2       link#3             UHS         lo0 <- Real IP

Pinging the backup modem from the .32.1 firewall router:

ping 192.168.23.1
PING 192.168.23.1 (192.168.23.1): 56 data bytes
64 bytes from 192.168.23.1: icmp_seq=0 ttl=64 time=0.477 ms
64 bytes from 192.168.23.1: icmp_seq=1 ttl=64 time=0.509 ms

Traceroute from within LAN sends the packets over default WAN into the internet where they die at my ISP

traceroute 192.168.23.1
traceroute to 192.168.23.1 (192.168.23.1), 30 hops max, 60 byte packets
 1  192.168.13.1 (192.168.13.1)  1.101 ms  1.087 ms  1.431 ms
 2  <some ISP IP number> (ISP IP number)  15.299 ms  15.883 ms  15.871 ms
 3  * * *

I have tried adding a route on the LAN server but that doesn't help either

route add -net 192.168.23.0/24 gw 192.168.32.1
route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.32.1    0.0.0.0         UG    0      0        0 eno1
192.168.23.0    192.168.32.1    255.255.255.0   UG    0      0        0 eno1
192.168.32.0    0.0.0.0         255.255.255.0   U     0      0        0 eno1

Why does the router try to send all packets over the default route when it actually knows the 23.0/24 network and it's interface that connects to that network? I thought the workflow is always like "look into the routing table if you know how to reach a network and if not, use the default route".

0

I suspect that the clients have 192.168.13.0/24 addresses. This means that the range 192.168.23.0/24 will be seen as foreign, therefore sent through the default gateway (.13.). If you need the backup router to be administerable, I'd suggest two options:

1) Put them into a common network, no need to have .13. and .23.

2) Create a routing rule in the main router to forward packets to the other router. This solution does have caveats: Route redirects would have to be disabled manually on the router because the clients can't connect directly despite it being the same segment. And if you wanted the main router to be administerable as well, adding a complementary rule to the backup one, be careful not to end up with a loop.

I suggest simply putting all devices in one segment. That's what CARP is about anyway. You aren't supposed to have different addresses for each redundant router.

  • Well no, the clients are on the LAN in the .32.0/24 network. The .13.1 exists between the router and the WAN modem. The router knows the .23.0 network as seen in it's routing table because it has an interface configured into the .23.0 and I can ping .23.1 from the router, but from within the .32.0 network I can't reach .23.0 - that's why I am wondering what's going on, I can connect to .32.1 and ping .23.0 from there but not from .32.0 where .32.1 serves as the gateway... – user6329530 Jun 18 '18 at 6:42
  • Oh, so you do have a single router between the LAN and the two DSL modems? Then I'm not sure if CARP is even the right solution. CARP, if I'm not mistaken, is for hardware redundancy where you have 2 routers on the same segment as the users. With your configuration, something like having two default routes with the same metric pointing to the two DSL modems could be enough. Haven't tested it. – Zdenek Jun 18 '18 at 16:47
  • Yes I have two routers and two DSL modems. CARP works for both, switching the DSL line if one goes down as well as switching the routers. (I know it's a bit confusing, I hope I explained it right). So DSL 1 is .13.0 DSL 2 is .23.0, LAN side is .32.0 and I want my network monitor in .32.0 to ping .23.0 since .23.0 also has a connection for a media box on dynamic DSL that's not supposed to be in the .32.0 LAN. Just the office LAN supposed to go via .23.0 if .13.0 internet dies. And I want to monitor .13.0 and .23.0 via PING from inside the office LAN. – user6329530 Jun 18 '18 at 16:54
  • The problem is that CARP, like link teaming, messes with the MAC address of the NIC. I might be starting to understand what's going on: You are trying to route to the other router via the LAN segment, but the MAC is changing. Find a different way to connect the two routers such that this link would not be managed by CARP. Either route through the WAN card if the modems and the WAN cards are all in the same segment, or if that can't be done, you may need a third NIC in both routers just to interconnect them. – Zdenek Jun 18 '18 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.