[LARTC] gateway failover with linux

[LARTC] gateway failover with linux

[Abhijit Menon-Sen]

Hi.

I'm wondering if there's a good way to configure a Linux firewall box to
failover to a single backup server, while preserving connection state.

This question has been asked before, but the latest reference I can find
is from 2004, at which time Linux had no equivalent of OpenBSD's pfsync,
though Harald was said to be working on one.

Did anything come of those efforts? Or is there now another alternative?

Any examples or advice would be appreciated.

Thank you.

-- ams
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] gateway failover with linux

[Grant Taylor]

On 07/19/07 12:02, Abhijit Menon-Sen wrote:
> I'm wondering if there's a good way to configure a Linux firewall box 
> to failover to a single backup server, while preserving connection 
> state.

I'm a bit confused, are you wanting a single Linux firewall / router to 
have redundant internet connections, or to route traffic to redundant 
systems behind it and intelligently handle the failure of one or more of 
said redundant systems?  I'm also not sure how conntrackd (comparable to 
OpenBSD's pfsync) is coming in to play here.  Or is there more than one 
Linux firewall / router that you are wanting to synchronize?  Or are you 
wanting the connection tracking between the multiple systems behind the 
Linux firewall / router?  I think that all of these are possible to 
various degrees, though each uses a different method to achieve it.

> This question has been asked before, but the latest reference I can 
> find is from 2004, at which time Linux had no equivalent of OpenBSD's 
> pfsync, though Harald was said to be working on one.

*nod*  Conntrackd is the tool that you want to use to synchronize 
connection tracking connection meta data between two systems, or the 
closest thing that Linux presently has (that I'm aware of).

> Did anything come of those efforts? Or is there now another 
> alternative?

Yes, conntrackd.

> Any examples or advice would be appreciated.

Will you please clarify what you are really wanting to do per above and 
I'll be more than happy to try to point you in the right direction.




Grant. . . .
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc