Choose a pfSense virtual IP by its ARP and service-binding behavior

A virtual address used for NAT does not necessarily behave like an address owned by a local service.

Source facts

Netgate distinguishes IP Alias, CARP, Proxy ARP, and Other virtual IPs. IP Alias addresses can answer ARP and bind local services. Proxy ARP provides Layer 2 replies, while Other suits addresses routed to the firewall without ARP. Proxy ARP and Other do not themselves answer ping without forwarding it to an internal target.

Source: Netgate — Virtual IP Addresses.

Applicability

This concerns pfSense VIP types and provider addressing arrangements.

DSE recommendation

DSE recommends obtaining the provider’s subnet and routing design before selecting a VIP type. State whether the address must be owned by a firewall service, translated to another host, or shared through an HA design. Avoid using an unanswered ping alone to declare a Proxy ARP address unusable. Include service listeners bound to all addresses in the exposure review because a new locally owned address can change where those services respond. Ask the provider and firewall owners to sign off on the same address-delivery diagram. For each extra address, mark the intended responder and service owner. Reject an acceptance result that tests only ICMP when the requirement is a local listener or translated application.

Verification

For an approved spare address, inspect the expected ARP or routed delivery path and test the actual intended protocol. Check local service binding and NAT independently. Record the selected VIP type and why its behavior matches the provider’s design.

Official reference

Netgate — Virtual IP Addresses. Reviewed October 20, 2026.