I'm trying to get a failover group to work, similar to the opnsense documentation.

The situation is different from the manual because the VMs only have 1 WAN network interface and no LAN interface. What I'm trying to do is to group both firewalls in a VPN and have pfsync use that tunnel for synchronisation. The "LAN" part will only be added at a later step as it's intended to be a VPN as well.

Interface asssignment on master FW:

WAN: vtnet0
SYNC: ovpns1 (the VPN server)

Interface assignement on backup FW:

WAN: vtnet0
SYNC: ovpnc1 (the VPN client)

The initial synchronisation (pfsync + xmlrpc) is confirmed in the master firewall's logfile (pfsync bulk start / done) and the configuration including VIP is correctly transmitted to the backup FW. Both nodes' network interfaces start advertising the different "skew" values for the virtual IP (0 on master, and 100 on backup).

But the VIP on the backup node is declared as "master", and the high-availability settings on the backup firewall just say "no backup node configured", and entering persistent CARP maintenance mode on the master does nothing on the backup FW.

The master's log shows the following output after entering persistent CARP maintenance mode:

Jul 17 09:30:00     opnsense: /firewall_virtual_ip.php: The command `/sbin/ifconfig 'vtnet0' -alias '111.222.333.45'' failed to execute
Jul 17 09:29:02     kernel: carp: demoted by -240 to 0 (sysctl)
Jul 17 09:28:10     kernel: carp: demoted by 240 to 240 (sysctl)
Jul 17 09:26:17     kernel: vtnet0: promiscuous mode disabled
Jul 17 09:26:17     kernel: carp: 192@vtnet0: MASTER -> INIT (hardware interface up)
Jul 17 09:26:17     kernel: ifa_maintain_loopback_route: deletion failed for interface vtnet0: 3
Jul 17 09:26:17     kernel: ifa_maintain_loopback_route: deletion failed for interface vtnet0: 3

vtnet0 has lost it's VIP alias, and the interface stops advertising the CARP address. The backup firewall still advertises as MASTER as it did before with unchanged skew (100). After leaving persistent CARP maintenance, the virtual IP remains lost on the main firewall, and it's only restored after repeated manual configuration steps.

Is it basically possible to use the master firewall as VPN server, and the backup firewall as VPN client? What kind of interface assignment/configuration would allow pfsync to fully work through a VPN tunnel?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.