Secondary addresses not ping-able

[tkurbad]

Hi,

I've successfully set up keepalived's VRRP component to implement an active/standby firewall configuration.

Everything works as expected, however one thing puzzles me:

We've got 64 external IP addresses, thus in my keepalived.conf, I've got sth. like:

# Primary IP
virtual_ipaddress {
     1.2.3.1/26 dev vrrp_extern_0
}

# Secondary IPs (got several of those blocks, each with 20 addresses)
virtual_ipaddress_excluded {
    1.2.3.2/26 dev vrrp_extern_0
    1.2.3.3/26 dev vrrp_extern_0
    1.2.3.4/26 dev vrrp_extern_0
    ...

Additionally, there's an iptables rule to open up ICMP:

iptables -t filter -A INPUT -p icmp -j ACCEPT

Now, from the outside, if I ping the primary address, I get a reply - everything works smoothly.
If, on the other hand, I ping one of the secondary addresses, I don't get a reply.

What am I doing wrong here?

Best,
Torsten

PS: iptables OUTPUT policy is ACCEPT.

[tkurbad]

My bad - the problem was hidden deep in my iptables rules.