conntrackd failback problem

["Nejc Škoberne" <nejc@skoberne.net>]

Hi,

I am building a 2-node cluster of bridging firewalls (filtering on br0 
bridge device with no IP address configured). Instead of keepalived and 
friends I am simply using Spanning Tree Protocol to fail over to slave 
bridge and fail back to the master. This works great, 10-seconds of 
switchover time is acceptable for me.

I want to have stateful firewall cluster, so that's why I am trying to 
use conntrackd to sync state between the two nodes. It works when the 
fail over occurs since the states are synced at that time (all the 
states which are bound at the time when both nodes are up, show up on 
both nodes). If the master node goes down, the STP does the switch and 
since the states are in place, everything works fine. However, when the 
master node comes back again, the STP does the failback, but the states 
are not synced back to the master by conntrackd.

How to fix this? Is there any better, more "proper" way to make a 
cluster of bridging firewalls?

Thanks,
Nejc