Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2 OpenBSD computers set up as firewalls between my network and the Internet. On the local network, fw1 has IP, and fw2 has IP, and they share using CARP. On the WAN, they have IPs and, and share (the real IP is a public IP). I have it set up like this in order to save public IPs; I don't have enough to give each firewall its own IP and use CARP on a third.

However, CARP doesn't seem to be working right. When I demote fw1, the internal CARP device switches to backup mode. However, the external interface stays in master mode. Oddly, fw2 also goes to master mode when I demote fw1, so there are 2 masters.

Any idea why that interface doesn't go to backup mode?

share|improve this question

The default behavior of CARP is to treat interfaces independently, so you can have one master and another slave interface in the same box.

To change this behavior, you have to change preempt flag to 1:

sysctl net.inet.carp.preempt=1

Here is an except from OpenBSD's FAQ:


Allow hosts within a redundancy group that have a better advbase and advskew to preempt the master. In addition, this option also enables failing over a group of interfaces together in the event that one interface goes down. If one physical CARP-enabled interface goes down, CARP will increase the demotion counter, carpdemote, by 1 on interface groups that the carp(4) interface is a member of, in effect causing all group members to fail-over together. net.inet.carp.preempt is 0 (disabled) by default.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .