Bug #3603
closed
Outbound NAT failure on Carp VIP after editing firewall rule.
0%
Description
pfSense version 2.1.1-RELEASE (amd64).
Hardware: HP DL380 G5 server with on board Broadcom nics and additional HP NC364T quad port nic.
I have the following setup; (see diagram)
dmz1 -> nat -> wan_vip (x.x.x.44)
external -> wan_vip (x.x.x.44) -> dmz_host
dmz2 -> nat -> wan_vip (x.x.x.45)
lan -> nat -> wan_vip (x.x.x.42/29)
This works fine, until I edit (don't even need to change) a firewall rule, at which point outbound NAT from DMZ-1 to x.x.x.44 stops working.
The inbound mapping stops working too.
Outbound NAT (though x.x.x.42/29) still works fine under these conditions, as does outbound NAT from DMZ-2 (which also goes out via x.x.x.42).
I am able to ping x.x.x.44, so the VIP is still up (and this is indicated as such in the CARP status).
However..
If I edit the CARP entry for .44 (not making any changes) - upon saving it, everything works fine again.
In summary:
1) Start an outbound ping from DMZ-1
2) Edit a firewall rule (no need to make any changes)
3) Save the rule, and click "Apply changes"
4) Ping stops almost immediately
5) Go to CARP, select the outbound CARP VIP for the DMZ
6) Edit, change nothing and save.
7) Ping begins responding again.
I have attached a diagram of our installation.
Files
Updated by Tony Rogers over 11 years ago
If it helps;
When this problem occurs and I edit the interface, I see (on the console):
wan_vip2: 2 Link states coalesced
Googling that suggests that the link state has changed rapidly, which I guess would be happening when I edit the CARP VIP.
wan_vip2 is the .44 IP mentioned above, and is displayed in the web gui as "x.x.x..44/29 (vhid 2)"
One final thing, I have already re-assigned the interface to another network card, and I have swapped out the switch that it's plugged in to. No difference.
Thanks.
Updated by Chris Buechler over 11 years ago
- Description updated (diff)
- Status changed from New to Rejected
this is a network problem of sorts, not a bug. continue the discussion on the forum.