pfSense » pfSense Plus

Jim Pingle wrote in #note-2:

Fixed in https://gitlab.netgate.com/pfSense/factory/-/commit/7694007e9570faecfd7150206bd029fba2bb4bf0

There is one caveat, which is that using an IPv6 LL sync peer doesn't work for unicast CARP. Using non-LL addresses is OK. The VIP itself can be LL, but the sync peer has to be non-LL. See #14385 for details on that.

Excuse me, Jim, is this a link to Netgate internal gitlab? I can't open it

Vladimir Suhhanov wrote in #note-4:

Jim Pingle wrote in #note-2:

Fixed in https://gitlab.netgate.com/pfSense/factory/-/commit/7694007e9570faecfd7150206bd029fba2bb4bf0

There is one caveat, which is that using an IPv6 LL sync peer doesn't work for unicast CARP. Using non-LL addresses is OK. The VIP itself can be LL, but the sync peer has to be non-LL. See #14385 for details on that.

Excuse me, Jim, is this a link to Netgate internal gitlab? I can't open it

No, it's public. I can access it even without being logged in. https://redmine.pfsense.org/issues/14385

Jim Pingle wrote in #note-5:

Vladimir Suhhanov wrote in #note-4:

Jim Pingle wrote in #note-2:

Fixed in https://gitlab.netgate.com/pfSense/factory/-/commit/7694007e9570faecfd7150206bd029fba2bb4bf0

There is one caveat, which is that using an IPv6 LL sync peer doesn't work for unicast CARP. Using non-LL addresses is OK. The VIP itself can be LL, but the sync peer has to be non-LL. See #14385 for details on that.

Excuse me, Jim, is this a link to Netgate internal gitlab? I can't open it

No, it's public. I can access it even without being logged in. https://redmine.pfsense.org/issues/14385

I mean this link https://gitlab.netgate.com/pfSense/factory/-/commit/7694007e9570faecfd7150206bd029fba2bb4bf0
Will this commit be added in the next build? How to test?

The URL for that commit is private, it will be in the next build.

You can try this patch in the meantime, which is the same as what is at that commit URL.

diff --git a/src/etc/inc/interfaces.inc b/src/etc/inc/interfaces.inc
index 3b100bb1048b394077c5f81ad59bf3b512440d27..85aa2f7b96b4545d5b9c26f0441fe3f298d9188b 100644
--- a/src/etc/inc/interfaces.inc
+++ b/src/etc/inc/interfaces.inc
@@ -3105,15 +3105,22 @@ function interface_carp_configure(&$vip, $ipalias_reload = false) {
     if (is_ipaddrv4($vip['subnet'])) {
         $subnet = escapeshellarg($vip['subnet']) . "/" . escapeshellarg($vip['subnet_bits']);
         $mode = ($vip['carp_mode'] == 'ucast' ? "peer ". escapeshellarg($vip['carp_peer']) : " mcast");
+        $family = 'inet';
     } elseif (is_ipaddrv6($vip['subnet'])) {
         $subnet = escapeshellarg($vip['subnet']) . " prefixlen " . escapeshellarg($vip['subnet_bits']);
+        /* Add link local scope if not already present */
+        if (is_linklocal($vip['carp_peer']) &&
+            (strpos($vip['carp_peer'], '%') === false)) {
+            $vip['carp_peer'] = $vip['carp_peer'] . '%' . $realif;
+        }
         $mode = ($vip['carp_mode'] == 'ucast' ? "peer6 ". escapeshellarg($vip['carp_peer']) : " mcast6");
+        $family = 'inet6';
     } else {
         log_error("VIP subnet {$vip['subnet']} on {$vip['interface']} is not a valid IP address");
         return;
     }

-    mwexec("/sbin/ifconfig {$realif} alias {$subnet} vhid " . escapeshellarg($vip['vhid']) .
+    mwexec("/sbin/ifconfig {$realif} {$family} alias {$subnet} vhid " . escapeshellarg($vip['vhid']) .
            " {$mode} {$advskew} {$advbase} {$password}");

     /* reconfigure stacked IP Aliases after CARP VIP changes
diff --git a/src/etc/rc.filter_synchronize b/src/etc/rc.filter_synchronize
index c8a8b38a3fe773f4fee596e3d771076880bf5fec..21fb6398b7c2cfcbcf79186c53f666d86d399e7e 100755
--- a/src/etc/rc.filter_synchronize
+++ b/src/etc/rc.filter_synchronize
@@ -52,7 +52,14 @@ function backup_vip_config_section() {
         }

         if (!empty($section['carp_peer'])) {
-            $if_addr = find_interface_ip(get_real_interface($section['interface']));
+            /* Use appropriate address family and type to match the peer */
+            if (is_ipaddrv4($section['carp_peer'])) {
+                $if_addr = find_interface_ip(get_real_interface($section['interface']));
+            } elseif (is_linklocal($section['carp_peer'])) {
+                $if_addr = find_interface_ipv6_ll(get_real_interface($section['interface']));
+            } elseif (is_ipaddrv6($section['carp_peer'])) {
+                $if_addr = find_interface_ipv6(get_real_interface($section['interface']));
+            }
             if (!empty($if_addr)) {
                 $section['carp_peer'] = $if_addr;
             }

Jim Pingle wrote in #note-7:

The URL for that commit is private, it will be in the next build.

You can try this patch in the meantime, which is the same as what is at that commit URL.

[...]

I confirm that after the patch everything works now without issues. Thanks, Jim!