pfSense Support Subscription

Author Topic: TCP Problems like unsymetric routing with CARP  (Read 115 times)

0 Members and 1 Guest are viewing this topic.

Offline blex

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
TCP Problems like unsymetric routing with CARP
« on: November 11, 2017, 06:52:40 pm »
Hi,

maybe you have an idear.

I have two PFSense boxes (Server). The Server have two 10Gbit nic's. They are configured as a lagg in failover. Ontop of that there are many vlans.
Each vlan has its own interface.

I have always 192.168.X.252 for fw1 and 192.168.X.253 for fw2. The carp adresse is 192.168.X.254.
CARP failover is working fine.

But then a PC for example in vlan 9 talks to a pc in vlan 20 the tcp backbackages are droped!

PROD_SRV   Default deny rule IPv4 (1PROD_SRV   Default deny rule IPv4 (1000000103)     192.168.40.36:49367     192.168.1.27:8194   TCP:PA000000103)     192.168.40.36:49367     192.168.1.27:8194   TCP:PA

As far as I unserstand pfSense there should be a TCP state and it should recocnise the pakages coming back from 192.168.1.27 to 192.168.40.36 since 192.168.40.36 created the connection.
Could this happen bause 192.168.1.27 has the CARP IP address as default GW AND the inital pakage has traveld from 192.168.40.36 to the carp through the fw and then exited on 192.168.1.252 to reach 192.168.1.27.

How can I bring the fw to use the CARP IP for routing outgoing pakages instead if its lokal IP?

Hope someone can point out how to fix this problem.