---
title: "Discussion on \"How to Give a pfSense HA BACKUP Node Access to Networks Behind VPN Tunnels\" | Hashnode"
description: "Discussion on \"How to Give a pfSense HA BACKUP Node Access to Networks Behind VPN Tunnels\". Fixing a \"blind\" CARP backup: a role-aware static route via Cron plus LAN firewall rules"
url: "https://hashnode.com/posts/how-to-give-a-pfsense-ha-backup-node-access-to-networks-behind-vpn-tunnels/6ad2131fa80d2f808d30ab2e"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [How to Give a pfSense HA BACKUP Node Access to Networks Behind VPN Tunnels](https://help.dc24.cloud/how-to-give-a-pfsense-ha-backup-node-access-to-networks-behind-vpn-tunnels?utm_source=hashnode&utm_medium=feed)

Fixing a "blind" CARP backup: a role-aware static route via Cron plus LAN firewall rules

Oct 16 · 7 min read · help.dc24.cloud  
Read the article

-   [#pfsense](https://hashnode.com/tag/pfsense)
-   [#networking](https://hashnode.com/tag/networking)
-   [#vpn](https://hashnode.com/tag/vpn)
-   [#firewall](https://hashnode.com/tag/firewall)
-   [#high-availability](https://hashnode.com/tag/high-availability)

## Written by

[Shevchenko Ivan](https://hashnode.com/@SIA13)

@SIA13 · UA

  
[View profile](https://hashnode.com/@SIA13)

## Responses 1

Markdown supported · ⌘↵ to post

[StackShortlist](https://hashnode.com/@veristria)

[Oct 16](https://hashnode.com/posts/how-to-give-a-pfsense-ha-backup-node-access-to-networks-behind-vpn-tunnels/6ad2131fa80d2f808d30ab2e/comment/6ad2b170a305ffe669184182)

The blind BACKUP node is easy to miss until a failover test, when you suddenly have no logs from the box that just took over. Worth adding to a checklist: after applying the fix, verify from a remote site that syslog, NTP and package updates all work from the BACKUP while it is still in backup state, not only after it becomes MASTER. That catches a broken route before a real outage does.