We have a machine running CentOS 7, running one virtual guest, using KVM. Firewalld is disabled and iptables is completely empty. The host is configured so the guest has multiple dedicated physical Ethernet ports, using macvtap adapters.

The guest is a pfSense firewall, using a CARP setup. Since this is a Linux forum, I'll point out that CARP is a failover mechanism, where two firewalls have their own physical IPs, and they share a virtual IP. The active firewall owns the virtual IP. Also, the MAC addresses for the two IPs - even on the same Ethernet interface - are different.

When I try to ping a remote host from the guest using its physical IP, everything works fine. With the virtual IP, it does not. Using tcpdump on the host, monitoring the physical Ethernet interface, I can see ping replies. Using tcpdump on the guest, I cannot. We tried using iptables with a "LOG" target, to see if we could find out why the packets are being dropped, but we're not getting anything there, either.

Anyone know what's going on, here?