I have 2 OpenBSD computers set up as firewalls between my network and the Internet. On the local network,
fw1 has IP
fw2 has IP
192.168.0.254, and they share
192.168.0.1 using CARP. On the WAN, they have IPs
192.168.1.254, and share
172.16.0.1 (the real IP is a public IP). I have it set up like this in order to save public IPs; I don't have enough to give each firewall its own IP and use CARP on a third.
However, CARP doesn't seem to be working right. When I demote
fw1, the internal CARP device switches to backup mode. However, the external interface stays in master mode. Oddly,
fw2 also goes to master mode when I demote
fw1, so there are 2 masters.
Any idea why that interface doesn't go to backup mode?