192.168.8.45(vrrp.ext.munnar.com)
|
|
_________________________________________________________
| |
| |
192.168.8.133(ext.ipt1.munnar.com) 192.16.8.132(ext.ipt2.munnar.com)
.................................. .................................
|192.168.57.3(ha.ipt1.munnar.com)|<<<------<<--->>------>>>|192.168.57.4(ha.ipt2.munnar.com)|
.................................. .................................
192.168.56.103(internal.ipt1.munnar.com) 192.168.56.102(internal.ipt2.munnar.com)
| |
| |
_________________________________________________________
|
|
192.168.56.100(vrrp.internal.munnar.com)
Scenario HA Firewall placed between internal and external network as you can assume it's multi homed. And controls access from external network to services hosted in internal networks.
We have dedicated VRRP placed on both networks, systems in external network have to set the external VRRP(vrrp.ext.munnar.com) as default gateway or have to use static route for destined internal network via external VRRP.
The same needs to be done from internal network as well for return traffic(in our scenario), systems in internal network needs to use either vrrp.internal.munnar.com as default gateway or need to use static route for external destination via vrrp.internal.munnar.com.
Network Configuration
| Primary | Secondary |
|---|---|
| host1:ipt1.munnar.com(Primary) | host2:ipt2.munnar.com(Secondary) |
| ha.ipt1.munnar.com | ha.ipt2.munnar.com |
| ext.ipt1.munnar.com | ext.ipt2.munnar.com |
| vrrp.ext.munnar.com | vrrp.ext.munnar.com |
| int.ipt1.munnar.com | int.ipt2.munnar.com |
| vrrp.internal.munnar.com | vrrp.internal.munnar.com |
Packages Required
keepalived - for VRRP
contrack-tools - Firewall session synchronization between firewalls
iptables-services - iptables startup package
Installation Steps
yum install iptables-services keepalived conntrack-tools -y
VRRP configuration
As depicted in the top layout, we are using two vrrp's one for external and another one for internal. The host ipt1.munnar.com acts as MASTER and ipt2.munnar.com is Backup.
Master Keepalived
Backup Keepalived
Conntrackd Configuration
Conntrackd is used to synchronize the existing firewall sessions thereby maintains ongoing connections during failover.
ha.ipt1.munnar.com and ha.ipt2.munnar.com are the dedicated interfaces used to sync the sessions. We need to copy two key files of conntrackd for configuration, copy /usr/share/doc/conntrack-tools-1.4.4/doc/sync/ftfw/conntrackd.conf as /etc/conntrackd/conntrackd.conf cp /usr/share/doc/conntrack-tools-1.4.4/doc/sync/ftfw/conntrackd.conf /etc/conntrackd/conntrackd.confand copy /usr/share/doc/conntrack-tools-1.4.4/doc/sync/primary-backup.sh to /etc/conntrackd/ /usr/share/doc/conntrack-tools-1.4.4/doc/sync/primary-backup.sh /etc/conntrackd/ and set executable bit.
Following screen-shots shows the minimal configuration required to use conntrackd.
ipt1 conntrackd
ipt2 conntrackd
Note: Conntrackd content is stripped to accommodate the content
Further we need to enable packet forwarding on both of our firewalls sysctl -w net.ipv4.ip_forward=1,make sure to set this in /etc/sysctl.conf to make persistent across reboots. And iptables need to have access rule configured in forward chain of Filter table in order to pass the traffic between source and destination.
In my case I have a webserver running in internal network(192.168.56.107) and a client machine running in external network, hence I have added the following rules for accessing http from client machine.
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -d 192.168.56.107/32 -p tcp -m tcp --dport 80 -j ACCEPT
All configuration can be found in github
Top comments (0)