Hi.
The issue is simple, I can't match the outgoing traffic to carp ip address.
When I go to some "show myip" web, it always appears the pysical one.
Never the carp one.
As my ISP provider gives us 4 ips, I use two (one for each nic of the firewalls
connected to internet) for physical interfaces and the other two for the carp
interfaces.
Internet
|
+--------------------/ \------------------+
| carp13(em0) = 81.92.37.13 |
| carp12(em0) = 81.92.37.12 |
| |
81.92.37.10 bge0 bge0 81.92.37.11
| |
+-------+ 10.0.0.2 +-------+
| fw0 |- re0 ---- CARP Pfsync ---- re0 -| fw1 |
+-------+ 10.0.0.1 +-------+
| |
192.168.28.1 bge1 bge1 192.169.28.2
| |
| carp28(em1) = 192.168.28.11 |
+--------------------\ /------------------+
|
Internal LAN
(192.168.28/24)
Config files(from one of the two firewalls):
hostname.bge0
inet 81.92.37.10 255.255.255.248 NONE
hostname.bge1
inet 192.168.28.1 255.255.255.0 NONE
hostname.carp12
inet 81.92.37.12 255.255.255.248 81.92.37.15 balancing ip carpnodes
120:0,121:100 pass PaSSWord12
hostname.carp13
inet 81.92.37.12 255.255.255.248 81.92.37.15 balancing ip carpnodes
130:100,131:0 pass PaSSWord13
hostname.carp28
inet 192.168.28.11 255.255.255.0 192.168.28.255 balancing ip carpnodes
28:0,29:100 pass PaSSWord28
hostname.re0
inet 10.0.0.1 255.255.255.0 NONE
hostname.pfsync0
up syncdev re0
sysctl.conf
net.inet.ip.forwarding=1 # 1=Permit forwarding (routing) of IPv4 packets
net.inet.icmp.rediraccept=1 # 1=Accept ICMP redirects
net.inet.carp.preempt=1 # 1=Enable carp(4) preemption
net.inet.carp.log=3 # log level of carp(4) info, default 2
net.inet.carp.allow=1
net.inet.carp.arpbalance=0
pf.conf
priv_nets= "{127.0.0.0/8, 172.16.0.0/12, 10.0.0.0/8}"
set block-policy drop
set skip on lo
#Nat outgoing connections
match out on $ext_IF inet from !$ext_IF to any nat-to $ext_IF
#This does not work: match out on $ext_IF inet from !$ext_IF to any nat-to
carp12
#Filter rules
block log all
block in quick from urpf-failed #spoofed address protection
#packet normaliztion
match in all scrub (no-df)
pass quick log on re0 inet proto pfsync keep state (no-sync)
pass in quick log on $ext_IF proto carp from carp12 to 224.0.0.18 keep state
pass in quick log on $ext_IF proto carp from carp13 to 224.0.0.18 keep state
pass in quick log on $int_IF proto carp from carp28 to 224.0.0.18 keep state
pass on { $int_IF , $ext_IF } proto carp keep state (no-sync)
block in quick on $ext_IF from $priv_nets to any
block out quick on $ext_IF from any to $priv_nets
block quick inet6
