Redundant routed VPS gateway pair completed

New downstream routing layer

SCComp has completed the internal deployment of a dedicated OPNsense 26.7 high-availability router pair for the VPS platform. These systems sit behind the existing production edge and are isolated from the management, switching, and hypervisor roles.

Routed public addressing

The customer network `198.44.26.192/26` is directly connected to the VPS routers. Its shared gateway is `198.44.26.193`, allowing future VPS instances to use real public IPv4 addresses instead of translating customer traffic behind a router address. Source NAT is disabled for this design.

High availability

• VPSRTR01 is the preferred router and VPSRTR02 is the standby.

• CARP protects both the upstream transit gateway and customer gateway.

• Both virtual addresses move together during failure.

• Firewall states synchronize over a dedicated private pfsync network.

• Configuration synchronization remains deliberately disabled so each initial router configuration can be audited independently.

Validation completed

All routed peer networks were identified and verified at layer 2 before policy was applied. CARP maintenance failover moved both gateways to the standby and restored them to the preferred router. Each router was then rebooted separately to prove persistence and takeover without taking down both nodes. Both pfsync interfaces returned healthy, management access remained available, the transit default route persisted, and no NAT translations were present.

Remaining upstream activation

The downstream pair is internally ready. Public Internet delivery still requires a static route for `198.44.26.192/26` through the new transit CARP address on the existing SCComp edge pair, followed by ColoCrossing and BGP activation and external ingress and egress testing. Those production-edge changes were intentionally kept outside this deployment.