[SOLVED] Proxmox + Pfsense CARP not working

Jul 28, 2020
2
0
1
34
Hello,

I am trying to configure a HA with 2 Pfsense VMs hosted on 2 physical proxmox servers.

Everything works well, excepted I am facing a problem to configure a public CARP IP on Pfsense VMs. Every public CARP IP created can not be accessed outside Pfsense network. Then both Pfsense VM are seeing as Master on the WAN interface (instead of Master/Backup).

While troubleshooting on Proxmox I were not able to see any multicast packets and we noticed also that Pfsense could not be able to create an ARP entry of that CARP IP.

Proxmox eth0 and vmbr0 (wan interface) are set on promiscuous mode. I've also disabled the multicast snooping. But still nothing works.

You will find attached the architecture in place

Any assistance is welcome

Proxmox installation
root@DECSLDPHYPPMX01:~# pveversion --verbose
proxmox-ve: 6.1-2 (running kernel: 5.3.13-2-pve)
pve-manager: 6.1-5 (running version: 6.1-5/9bf06119)
pve-kernel-5.3: 6.1-2
pve-kernel-helper: 6.1-2
pve-kernel-4.15: 5.4-12
pve-kernel-5.3.13-2-pve: 5.3.13-2
pve-kernel-4.15.18-24-pve: 4.15.18-52
pve-kernel-4.15.18-12-pve: 4.15.18-36
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.0.2-pve4
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: residual config
ifupdown2: 3.0.0-1+pve2
ksm-control-daemon: 1.3-1
libjs-extjs: 6.0.1-10
libknet1: 1.13-pve1
libpve-access-control: 6.0-5
libpve-apiclient-perl: 3.0-2
libpve-common-perl: 6.1-3
libpve-guest-common-perl: 3.0-3
libpve-http-server-perl: 3.0-3
libpve-storage-perl: 6.1-3
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve3
lxc-pve: 3.2.1-1
lxcfs: 3.0.3-pve60
novnc-pve: 1.1.0-1
openvswitch-switch: 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-12+deb10u2
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.1-2
pve-cluster: 6.1-3
pve-container: 3.0-18
pve-docs: 6.1-3
pve-edk2-firmware: 2.20191127-1
pve-firewall: 4.0-9
pve-firmware: 3.0-4
pve-ha-manager: 3.0-8
pve-i18n: 2.0-3
pve-qemu-kvm: 4.1.1-2
pve-xtermjs: 4.3.0-1
qemu-server: 6.1-4
smartmontools: 7.1-pve2
spiceterm: 3.1-1
vncterm: 1.6-1
zfsutils-linux: 0.8.3-pve1



best regards
Stephane
 

Attachments

  • HA_Pfsense_Archi-Anonymized.pdf
    67.8 KB · Views: 27
Last edited:
While troubleshooting on Proxmox I were not able to see any multicast packets and we noticed also that Pfsense could not be able to create an ARP entry of that CARP IP.


Hi,

I do not know Pfsense, but I know ucarp implementation on linux (is a fork from bsd if I remember). I use a centos CT with ucarp for some time in PMX 5 and now 6.x. The other ucarp is running on host outside of PMX ona bare-metal server. During this time ucarp have working on this CT without any problem. So I can only guess that could maybe be only a firewall problem in your case!

Good luck / Bafta !
 
hi,

Thank you for your hint. Indeed it helps me focusing only on the firewall and I fixed the problem by enabling promiscuous on wan interface (ifconfig vtnet0 promisc)

Regards
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!