Pfsense HA/Failover Question

I am a novice homelab-er and currently run pfsense on bare metal, but am looking to put it under proxmox and pass through my quad NIC.

I understand the limitations of virtual (host goes down, I’m SOL being the big one), but I run a proxmox host next to a PC running pfsense and would like to get proxmox on both for some other homelab reasons such as start playing with clusters and such. I figured… why not run pfsense on both to help reduce my potential downtime and issues with it being virtual.

The question now becomes - how would one do this. From my understanding I wouldn’t be able to use the HA functionality within pfsense as that requires CARP which has requirements my home environment can’t provide such as multiple public IP’s, but I figure there has to be some sort of smart way to go about this.

The “dumb way” I have in my mind is have two VM’s, one on each host, that are configured identically, literally load the same XML into both, and if the main host goes down, swap cables from main host to secondary and state tables will be lost, but pfsense “should” start doing its thing. Basically leave a vm running on the second host with no network plugs physically attached, but once they are attached it should theoretically all work, right? Or would the MAC address conflicts of the NIC’s cause an issue when things try and route? Hmm.

I know enough to know that I don’t know enough… I assume even if there are initial routing issues due to MAC address changes, they would work out quickly, and this is really just a “oh shit I need networking” solution, and would allow me to at least have my LAN up so I can get into the main host and fix whatever issue happened, at which point I would move the physical cables back to the main host.

Theoretically, will this work? Is there an even less janky way to do this?

For setting up HA at home that would work, you would do all the internal setup the same for HA, but for the external just leave the WAN alone as a single IP or how ever you have it configured.

1 Like

Is there a way to do state table and more importantly setting syncing between the without CARP? I think pfsense has a separate XMLsync tool, I’m on my phone so quick references are hard. But from what I have read I think there are 3 parts to HA, one is CARP, one is settings, and one is something else.

Could I run the xml bit stand alone so the two VM’s are always in sync? That way I could literally just swap cables whenever I want, and states may need to re-establish but settings will always be in sync. Each client will have its own quad NIC passes through with unit 2 ports being used, one for LAN one for WAN, if that helps with config at all, basically leaves two ports for direct connections if needed.

If you WAN is not in sync then there is no point in syncing the state tables.

1 Like