Date: Tue, 28 May 2024 10:28:53 +0200 From: Alejandro Imass <aimass@yabarana.com> To: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Cannot connect to master IPs from CARP backup Message-ID: <CAHieY7QXghLWBfm03BRwAyzGAdyyH8Ax5pbcvuc2u8am6e45BQ@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
--0000000000003a156606197f6d71 Content-Type: text/plain; charset="UTF-8" Hi, I have a CARP setup which works as expected except that from the backup server, it is impossible to connect to VIPs on the master. I have read several similar threads: https://www.reddit.com/r/PFSENSE/comments/15s6e8j/carp_backup_node_unable_to_ping_vips/ https://forums.freebsd.org/threads/carp-problem-ping-only-works-from-the-master-itself.14986/ https://forums.freebsd.org/threads/pf-carp-cant-ping-vip.6039/ My situation is specifically: - CARP works, and failover works - I can ping the master VIP from any other server on the LAN - Ping only fails from inside the backup server, if and only if, the backup IPs are up in backup state My configuration is based on jails: ip6 = disable; interface = em1; ip4.addr = 10.77.3.11/22; ip4.addr += "10.77.0.100/22 vhid 10 advbase 1 advskew 100 pass yuca"; ip4.addr += "10.77.0.101/22 vhid 138 advbase 1 advskew 100 pass yuca"; I do notice a warning each time saying this: invalid netmask '/22 vhid 138 advbase 1 advskew 0 pass yuca' I'm using Bastille jails and haven't looked deeply into the error above because since ifconfig shows the interface properly configured. But perhaps this is an important clue? I have tried /32 netmask, broadcast to the specific CARP IPs, promiscuous mode and almost anything I can think of, and in every combination CARP seems to work fine except for this one issue where I cannot connect to the VIPs from the backup whilst in backup mode. I have tcp dumped arp traffic and the arp tables everywhere seem correct, even in the backup server, with and without the VIPs active on the backup. Here is one additional clue and not sure if this is relevant. When I use CARP alias in the jails as specified above, and I run PostgreSQL with listen * then I notice that it binds to *:5432 on the base host and not on the specific jail IPs like a normal jail would do if I did not use the alias. It has made me wonder if something Bastille does is conflicting with the CARP aliases I am setting up above. But since everything else works as expected I really haven't delved deep into Bastille does for NIC aliases. Version is 14.0-RELEASE standard kernel and everything else is pretty standard. Any help or ideas greatly appreciated !! Best, -- Alex --0000000000003a156606197f6d71 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi,<div><br></div><div>I have a CARP setup which works as = expected except that from the backup server, it is impossible to connect to= VIPs on the master. I have read several similar threads:</div><div><br></d= iv><div><div><a href=3D"https://www.reddit.com/r/PFSENSE/comments/15s6e8j/c= arp_backup_node_unable_to_ping_vips/">https://www.reddit.com/r/PFSENSE/comm= ents/15s6e8j/carp_backup_node_unable_to_ping_vips/</a><br></div><a href=3D"= https://forums.freebsd.org/threads/carp-problem-ping-only-works-from-the-ma= ster-itself.14986/">https://forums.freebsd.org/threads/carp-problem-ping-on= ly-works-from-the-master-itself.14986/</a><br class=3D"gmail-Apple-intercha= nge-newline"></div><div><a href=3D"https://forums.freebsd.org/threads/pf-ca= rp-cant-ping-vip.6039/">https://forums.freebsd.org/threads/pf-carp-cant-pin= g-vip.6039/</a><br></div><div><br></div><div>My situation is specifically:<= /div><div><ul><li>CARP works, and failover works<br></li><li>I can ping the= master VIP from any other server on the LAN</li><li>Ping only fails from i= nside the backup server, if and only if, the backup IPs are up in backup st= ate</li></ul><div>My configuration is based on jails:</div></div><div><br><= /div><div>=C2=A0 ip6 =3D disable;<br></div><div>=C2=A0 interface =3D em1;<b= r>=C2=A0 ip4.addr =3D <a href=3D"http://10.77.3.11/22">10.77.3.11/22</a>;<b= r>=C2=A0 ip4.addr +=3D "<a href=3D"http://10.77.0.100/22">10.77.0.100/= 22</a> vhid 10 advbase 1 advskew 100 pass yuca";<br>=C2=A0 ip4.addr += =3D "<a href=3D"http://10.77.0.101/22">10.77.0.101/22</a>; vhid 138 adv= base 1 advskew 100 pass yuca";<br></div><div><br></div><div>I do notic= e a warning each time saying this:</div><div>invalid netmask '/22 vhid = 138 advbase 1 advskew 0 pass yuca'<br></div><div><br></div><div>I'm= using Bastille jails and haven't looked deeply into the error above be= cause since ifconfig shows the interface properly configured. But perhaps t= his is an important clue?</div><div><br></div><div>I have tried /32 netmask= , broadcast to the specific CARP IPs, promiscuous mode and almost anything = I can think of, and in every combination CARP seems to work fine except for= this one issue where I cannot connect to the VIPs from the backup whilst= =C2=A0in backup mode.</div><div><br></div><div>I have tcp dumped arp traffi= c and the arp tables everywhere seem correct, even in the backup server, wi= th and without the VIPs active on the backup.=C2=A0</div><div><br></div><di= v>Here is one additional clue and not sure if this is relevant. When I use = CARP alias in the jails as specified above, and I run PostgreSQL with liste= n * then I notice that it binds to *:5432 on the base host and not on the s= pecific jail IPs like a normal jail would do if I did not use the alias. It= has made me wonder if something Bastille does is conflicting with the CARP= aliases I am setting up above. But since everything else works as expected= I really haven't delved deep into Bastille does for NIC aliases.=C2=A0= </div><div><br></div><div>Version is=C2=A014.0-RELEASE standard kernel and = everything else is pretty standard.</div><div><br></div><div>Any help or id= eas greatly appreciated=C2=A0!!</div><div><br></div><div>Best,</div><div><b= r></div><div>--=C2=A0</div><div>Alex</div><div><br></div><div><br></div><di= v><br></div></div> --0000000000003a156606197f6d71--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAHieY7QXghLWBfm03BRwAyzGAdyyH8Ax5pbcvuc2u8am6e45BQ>