Iptables - High availability

Karthik — Tue, 09 Jun 2020 14:04:56 +0000

                             192.168.8.45(vrrp.ext.munnar.com)
                                         |
                                         |
              _________________________________________________________
             |                                                         |
             |                                                         |
192.168.8.133(ext.ipt1.munnar.com)                         192.16.8.132(ext.ipt2.munnar.com)

..................................                         .................................
|192.168.57.3(ha.ipt1.munnar.com)|<<<------<<--->>------>>>|192.168.57.4(ha.ipt2.munnar.com)|
..................................                         .................................



192.168.56.103(internal.ipt1.munnar.com)                   192.168.56.102(internal.ipt2.munnar.com)
             |                                                         |
             |                                                         |
              _________________________________________________________
                                        |
                                        |
                           192.168.56.100(vrrp.internal.munnar.com)

Scenario HA Firewall placed between internal and external network as you can assume it's multi homed. And controls access from external network to services hosted in internal networks.

We have dedicated VRRP placed on both networks, systems in external network have to set the external VRRP(vrrp.ext.munnar.com) as default gateway or have to use static route for destined internal network via external VRRP.
The same needs to be done from internal network as well for return traffic(in our scenario), systems in internal network needs to use either vrrp.internal.munnar.com as default gateway or need to use static route for external destination via vrrp.internal.munnar.com.

Network Configuration

Primary	Secondary
host1:ipt1.munnar.com(Primary)	host2:ipt2.munnar.com(Secondary)
ha.ipt1.munnar.com	ha.ipt2.munnar.com
ext.ipt1.munnar.com	ext.ipt2.munnar.com
vrrp.ext.munnar.com	vrrp.ext.munnar.com
int.ipt1.munnar.com	int.ipt2.munnar.com
vrrp.internal.munnar.com	vrrp.internal.munnar.com

Packages Required

keepalived - for VRRP
contrack-tools - Firewall session synchronization between firewalls
iptables-services - iptables startup package

Installation Steps

yum install iptables-services keepalived conntrack-tools -y

VRRP configuration

As depicted in the top layout, we are using two vrrp's one for external and another one for internal. The host ipt1.munnar.com acts as MASTER and ipt2.munnar.com is Backup.

Master Keepalived

Backup Keepalived

Conntrackd Configuration

Conntrackd is used to synchronize the existing firewall sessions thereby maintains ongoing connections during failover.
ha.ipt1.munnar.com and ha.ipt2.munnar.com are the dedicated interfaces used to sync the sessions. We need to copy two key files of conntrackd for configuration, copy /usr/share/doc/conntrack-tools-1.4.4/doc/sync/ftfw/conntrackd.conf as /etc/conntrackd/conntrackd.conf cp /usr/share/doc/conntrack-tools-1.4.4/doc/sync/ftfw/conntrackd.conf /etc/conntrackd/conntrackd.confand copy /usr/share/doc/conntrack-tools-1.4.4/doc/sync/primary-backup.sh to /etc/conntrackd/ /usr/share/doc/conntrack-tools-1.4.4/doc/sync/primary-backup.sh /etc/conntrackd/ and set executable bit.
Following screen-shots shows the minimal configuration required to use conntrackd.

ipt1 conntrackd

ipt2 conntrackd

Note: Conntrackd content is stripped to accommodate the content

Further we need to enable packet forwarding on both of our firewalls sysctl -w net.ipv4.ip_forward=1,make sure to set this in /etc/sysctl.conf to make persistent across reboots. And iptables need to have access rule configured in forward chain of Filter table in order to pass the traffic between source and destination.
In my case I have a webserver running in internal network(192.168.56.107) and a client machine running in external network, hence I have added the following rules for accessing http from client machine.

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -d 192.168.56.107/32 -p tcp -m tcp --dport 80 -j ACCEPT

All configuration can be found in github