Hi.
The issue is simple, I can't match the outgoing traffic to carp ip address.
When I go to some "show myip" web, it always appears the pysical one. 
Never the carp one.

As my ISP provider gives us 4 ips, I use two (one for each nic of the firewalls
connected to internet) for physical interfaces and the other two for the carp
interfaces.
                                  

                                      Internet
                                         |
                   +--------------------/ \------------------+
                   |         carp13(em0) = 81.92.37.13       |
                   |         carp12(em0) = 81.92.37.12       |
                   |                                         |
      81.92.37.10 bge0                                      bge0 81.92.37.11
                   |                                         |
               +-------+                    10.0.0.2     +-------+
               |  fw0  |- re0 ---- CARP Pfsync ---- re0 -|  fw1  |
               +-------+  10.0.0.1                       +-------+
                   |                                         |
    192.168.28.1 bge1                                       bge1 192.169.28.2
                   |                                         |
                   |         carp28(em1) = 192.168.28.11     |
                   +--------------------\ /------------------+
                                         |
                                   Internal LAN 
                                  (192.168.28/24)


Config files(from one of the two firewalls):

hostname.bge0
inet 81.92.37.10 255.255.255.248 NONE

hostname.bge1
inet 192.168.28.1 255.255.255.0 NONE

hostname.carp12
inet 81.92.37.12 255.255.255.248 81.92.37.15 balancing ip carpnodes
120:0,121:100 pass PaSSWord12

hostname.carp13
inet 81.92.37.12 255.255.255.248 81.92.37.15 balancing ip carpnodes
130:100,131:0 pass PaSSWord13

hostname.carp28
inet 192.168.28.11 255.255.255.0 192.168.28.255 balancing ip carpnodes
28:0,29:100 pass PaSSWord28

hostname.re0
inet 10.0.0.1 255.255.255.0 NONE

hostname.pfsync0
up syncdev re0

sysctl.conf
net.inet.ip.forwarding=1        # 1=Permit forwarding (routing) of IPv4 packets
net.inet.icmp.rediraccept=1     # 1=Accept ICMP redirects
net.inet.carp.preempt=1 # 1=Enable carp(4) preemption
net.inet.carp.log=3             # log level of carp(4) info, default 2
net.inet.carp.allow=1
net.inet.carp.arpbalance=0

pf.conf
priv_nets= "{127.0.0.0/8, 172.16.0.0/12, 10.0.0.0/8}"
set block-policy drop
set skip on lo

#Nat outgoing connections
match out on $ext_IF inet from !$ext_IF to any nat-to $ext_IF

#This does not work: match out on $ext_IF inet from !$ext_IF to any nat-to 
carp12

#Filter rules
block log all
block in quick from urpf-failed         #spoofed address protection

#packet normaliztion
match in all scrub (no-df)

pass quick log on re0 inet proto pfsync keep state (no-sync)
pass in quick log on $ext_IF proto carp from carp12 to 224.0.0.18 keep state
pass in quick log on $ext_IF proto carp from carp13 to 224.0.0.18 keep state
pass in quick log on $int_IF proto carp from carp28 to 224.0.0.18 keep state
pass on { $int_IF , $ext_IF } proto carp keep state (no-sync)

block in quick on $ext_IF from $priv_nets to any
block out quick on $ext_IF from any to $priv_nets
block quick inet6

Reply via email to