Using heartbeat for fall over on IPTables Firewall

Using heartbeat for fall over on IPTables Firewall

[Chip Upsal]

I am looking to use heartbeat to provide fall over for my iptables firewall.
I am looking for those with experience using these tools together. 

I plan to use RH7.2 on the firewalls.

I made some attempts at implementing such a solution but i ran into a few
problems. 

I would like suggestions on setup of the heartbeat configuration files.
Pointers on the iptables startup script. and advice on what kernel version
to use and if any patches need to be applied.

Thanks in advance,

Chip




Chip Upsal
SysAdmin
CyberWolf Inc

Re: Using heartbeat for fall over on IPTables Firewall

[Antonio Paulo Salgado Forster]

Suggestion: Try using keepalived instead.

Regards,

Forster


Chip Upsal <cupsal@cyberwolf.com>@lists.netfilter.org on 03/17/2003
01:16:46 PM

Sent by:    netfilter-admin@lists.netfilter.org


To:    netfilter@lists.netfilter.org, "'linux-ha@muc.de'" <linux-ha@muc.de>
cc:
Subject:    Using heartbeat for fall over on IPTables Firewall



I am looking to use heartbeat to provide fall over for my iptables
firewall.
I am looking for those with experience using these tools together.

I plan to use RH7.2 on the firewalls.

I made some attempts at implementing such a solution but i ran into a few
problems.

I would like suggestions on setup of the heartbeat configuration files.
Pointers on the iptables startup script. and advice on what kernel version
to use and if any patches need to be applied.

Thanks in advance,

Chip




Chip Upsal
SysAdmin
CyberWolf Inc

Re: Using heartbeat for fall over on IPTables Firewall

[Marc Cluet]

On Mon, 17 Mar 2003, Chip Upsal wrote:

> I am looking to use heartbeat to provide fall over for my iptables firewall.
> I am looking for those with experience using these tools together. 
> 
> I plan to use RH7.2 on the firewalls.
> 
> I made some attempts at implementing such a solution but i ran into a few
> problems. 
> 
> I would like suggestions on setup of the heartbeat configuration files.
> Pointers on the iptables startup script. and advice on what kernel version
> to use and if any patches need to be applied.
> 
> Thanks in advance,
> 
> Chip
> 

Right now I have this solution in production stage, using iptables + heartbeat + ldirectord using NAT.
If you don't need backend balancing and only need high availability on the firewalls then you can skip out NAT and ldirectord :)

What I have is a custom made iptables script that is based on input/output ethernets and also on concrete destination IPs, once you have those rules loaded you can shift your firewall from one firewall box to another without even restarting iptables.

What you really need to be aware of is ARP tables on your network since that can make your transition fail, read arping man page for fast arp transition or the solutions suggested at the Linux-ha FAQ.

If you need more details about my installation just let me know.

Good luck


---

Marc Cluet                      | lynxman@lynxman.net
http://www.lynxman.net          | lynxman@cistelecom.net
--------------------------------------------------------

RE: Using heartbeat for fall over on IPTables Firewall

[Elmshauser, Erik]

	I did something a few years ago with Redhat.  I think they have
a package called 'Piranha'
(http://www.redhat.com/support/wpapers/piranha).  I remember not being
pleased with it and using Ultra Monkey (http://www.ultramonkey.org)
instead.

	That was a few years back though, so take a look, who knows what
has changed since then.

	--Erik

Rev. Dr. Erik C Elmshauser D.D.
Head of I.T.
Pacific Benefits Group NW LLC
erike@pbgnw.com
Phone  - 800.259.0455
Fax    - 800.662.0082
 There are 10 kinds of people in the world,
Those that can do binary arithmetic, and those that can't.

> -----Original Message-----
> From: Chip Upsal [mailto:cupsal@cyberwolf.com]
> Sent: Monday, March 17, 2003 8:17 AM
> To: netfilter@lists.netfilter.org; 'linux-ha@muc.de'
> Subject: Using heartbeat for fall over on IPTables Firewall
> 
> I am looking to use heartbeat to provide fall over for my iptables
firewall.
> I am looking for those with experience using these tools together.
> 
> I plan to use RH7.2 on the firewalls.
> 
> I made some attempts at implementing such a solution but i ran into a
few
> problems.
> 
> I would like suggestions on setup of the heartbeat configuration
files.
> Pointers on the iptables startup script. and advice on what kernel
version
> to use and if any patches need to be applied.
> 
> Thanks in advance,
> 
> Chip
> 
> 
> 
> 
> Chip Upsal
> SysAdmin
> CyberWolf Inc

Re: Using heartbeat for fall over on IPTables Firewall

[Kevin Dwyer]

On Mon, 17 Mar 2003 09:16:46 -0700
Chip Upsal <cupsal@cyberwolf.com> wrote:

> I am looking to use heartbeat to provide fall over for my iptables
> firewall. I am looking for those with experience using these tools
> together. 
> 
> I plan to use RH7.2 on the firewalls.

I've been using a modified debian, but most distributions should be
fine.

> I made some attempts at implementing such a solution but i ran into a
> few problems. 
> 
> I would like suggestions on setup of the heartbeat configuration
> files. Pointers on the iptables startup script. and advice on what
> kernel version to use and if any patches need to be applied.

One way to do it is to setup heartbeat with ipfail.  Consult the mailing
list archives and the documentation for more details.

You'll probably want a fairly generic ruleset that you can apply to both
firewalls.  I've successfully done this by hand and with fwbuilder.

Depending on how you set things up you may or may not need a resource
script for heartbeat to execute when the firewall picks up the virtual
IP or loses it.  I had to do this to handle problems with both machines
holding the same aliases for my NATs.  Sometimes that will create some
ARP hell, but it's very situation dependent.  If you need to do this,
consult the scripts that are installed in $sysconfdir/ha.d/resource.d/
for examples.

The one big thing that is missing from this setup is state table
replication.  I've been interested in getting that working but the
nf-failover list has been quiet, and I haven't had a lot of free time to
poke at code.  If anyone out there is interested in working on it, I'd
like to hear from you.

-- 
/* kevin@pheared.net               http://pheared.net/devel/ */
/* Network Security Engineer       http://pheared.net/~kevin */
/* Sabotage will set us free.   Throw a rock in the machine. */
/*   >++++++++++[<++++++++++>-]<.+++++.----.[-]++++++++++.   */

Re: Using heartbeat for fall over on IPTables Firewall

[Steve Mickeler]

I'll second the vote for keepalived.

Its an amazing tool.

http://www.keepalived.org/




On Mon, 17 Mar 2003, Antonio Paulo Salgado Forster wrote:

>
> Suggestion: Try using keepalived instead.
>
> Regards,
>
> Forster
>
>
> Chip Upsal <cupsal@cyberwolf.com>@lists.netfilter.org on 03/17/2003
> 01:16:46 PM
>
> Sent by:    netfilter-admin@lists.netfilter.org
>
>
> To:    netfilter@lists.netfilter.org, "'linux-ha@muc.de'" <linux-ha@muc.de>
> cc:
> Subject:    Using heartbeat for fall over on IPTables Firewall
>
>
>
> I am looking to use heartbeat to provide fall over for my iptables
> firewall.
> I am looking for those with experience using these tools together.
>
> I plan to use RH7.2 on the firewalls.
>
> I made some attempts at implementing such a solution but i ran into a few
> problems.
>
> I would like suggestions on setup of the heartbeat configuration files.
> Pointers on the iptables startup script. and advice on what kernel version
> to use and if any patches need to be applied.
>
> Thanks in advance,
>
> Chip
>
>
>
>
> Chip Upsal
> SysAdmin
> CyberWolf Inc
>
>
>
>
>

RE: Using heartbeat for fall over on IPTables Firewall

[Chip Upsal]

in what ways is this better then heartbeat?

-----Original Message-----
From: Steve Mickeler [mailto:steve@warning.ca]
Sent: Monday, March 17, 2003 1:39 PM
To: Antonio Paulo Salgado Forster
Cc: Chip Upsal; netfilter@lists.netfilter.org
Subject: Re: Using heartbeat for fall over on IPTables Firewall



I'll second the vote for keepalived.

Its an amazing tool.

http://www.keepalived.org/




On Mon, 17 Mar 2003, Antonio Paulo Salgado Forster wrote:

>
> Suggestion: Try using keepalived instead.
>
> Regards,
>
> Forster
>
>
> Chip Upsal <cupsal@cyberwolf.com>@lists.netfilter.org on 03/17/2003
> 01:16:46 PM
>
> Sent by:    netfilter-admin@lists.netfilter.org
>
>
> To:    netfilter@lists.netfilter.org, "'linux-ha@muc.de'"
<linux-ha@muc.de>
> cc:
> Subject:    Using heartbeat for fall over on IPTables Firewall
>
>
>
> I am looking to use heartbeat to provide fall over for my iptables
> firewall.
> I am looking for those with experience using these tools together.
>
> I plan to use RH7.2 on the firewalls.
>
> I made some attempts at implementing such a solution but i ran into a few
> problems.
>
> I would like suggestions on setup of the heartbeat configuration files.
> Pointers on the iptables startup script. and advice on what kernel version
> to use and if any patches need to be applied.
>
> Thanks in advance,
>
> Chip
>
>
>
>
> Chip Upsal
> SysAdmin
> CyberWolf Inc
>
>
>
>
>

RE: Using heartbeat for fall over on IPTables Firewall

[Steve Mickeler]

Just off the top of my head:

1) heartbeat is limited to 2 nodes

2) keepalived config is much cleaner and easier to manage.



On Mon, 17 Mar 2003, Chip Upsal wrote:

> in what ways is this better then heartbeat?
>
> -----Original Message-----
> From: Steve Mickeler [mailto:steve@warning.ca]
> Sent: Monday, March 17, 2003 1:39 PM
> To: Antonio Paulo Salgado Forster
> Cc: Chip Upsal; netfilter@lists.netfilter.org
> Subject: Re: Using heartbeat for fall over on IPTables Firewall
>
>
>
> I'll second the vote for keepalived.
>
> Its an amazing tool.
>
> http://www.keepalived.org/
>
>
>
>
> On Mon, 17 Mar 2003, Antonio Paulo Salgado Forster wrote:
>
> >
> > Suggestion: Try using keepalived instead.
> >
> > Regards,
> >
> > Forster
> >
> >
> > Chip Upsal <cupsal@cyberwolf.com>@lists.netfilter.org on 03/17/2003
> > 01:16:46 PM
> >
> > Sent by:    netfilter-admin@lists.netfilter.org
> >
> >
> > To:    netfilter@lists.netfilter.org, "'linux-ha@muc.de'"
> <linux-ha@muc.de>
> > cc:
> > Subject:    Using heartbeat for fall over on IPTables Firewall
> >
> >
> >
> > I am looking to use heartbeat to provide fall over for my iptables
> > firewall.
> > I am looking for those with experience using these tools together.
> >
> > I plan to use RH7.2 on the firewalls.
> >
> > I made some attempts at implementing such a solution but i ran into a few
> > problems.
> >
> > I would like suggestions on setup of the heartbeat configuration files.
> > Pointers on the iptables startup script. and advice on what kernel version
> > to use and if any patches need to be applied.
> >
> > Thanks in advance,
> >
> > Chip
> >
> >
> >
> >
> > Chip Upsal
> > SysAdmin
> > CyberWolf Inc
> >
> >
> >
> >
> >
>

RE: Using heartbeat for fall over on IPTables Firewall

[Antonio Paulo Salgado Forster]

a few more reasons:

3)  faster takeover;

4)  "guaranteed persistence routing path" (from keepalived.org) -  the
famous  sync_groups

5) interface flags monitoring (through VRRP framework);

6) etc;

7) etc;

IMHO, heartbeat is great for applications servers such as DBs, web servers,
(using) shared disks,  etc.  For routers, firewalls or load balancers,
keepalived rulez.

Read the documentation at web site...

Forster



Steve Mickeler <steve@warning.ca> on 03/17/2003 07:08:26 PM

To:    Chip Upsal <cupsal@cyberwolf.com>
cc:    Antonio Paulo Salgado Forster/Brazil/IBM@IBMBR,
       netfilter@lists.netfilter.org
Subject:    RE: Using heartbeat for fall over on IPTables Firewall





Just off the top of my head:

1) heartbeat is limited to 2 nodes

2) keepalived config is much cleaner and easier to manage.



On Mon, 17 Mar 2003, Chip Upsal wrote:

> in what ways is this better then heartbeat?
>
> -----Original Message-----
> From: Steve Mickeler [mailto:steve@warning.ca]
> Sent: Monday, March 17, 2003 1:39 PM
> To: Antonio Paulo Salgado Forster
> Cc: Chip Upsal; netfilter@lists.netfilter.org
> Subject: Re: Using heartbeat for fall over on IPTables Firewall
>
>
>
> I'll second the vote for keepalived.
>
> Its an amazing tool.
>
> http://www.keepalived.org/
>
>
>
>
> On Mon, 17 Mar 2003, Antonio Paulo Salgado Forster wrote:
>
> >
> > Suggestion: Try using keepalived instead.
> >
> > Regards,
> >
> > Forster
> >
> >
> > Chip Upsal <cupsal@cyberwolf.com>@lists.netfilter.org on 03/17/2003
> > 01:16:46 PM
> >
> > Sent by:    netfilter-admin@lists.netfilter.org
> >
> >
> > To:    netfilter@lists.netfilter.org, "'linux-ha@muc.de'"
> <linux-ha@muc.de>
> > cc:
> > Subject:    Using heartbeat for fall over on IPTables Firewall
> >
> >
> >
> > I am looking to use heartbeat to provide fall over for my iptables
> > firewall.
> > I am looking for those with experience using these tools together.
> >
> > I plan to use RH7.2 on the firewalls.
> >
> > I made some attempts at implementing such a solution but i ran into a
few
> > problems.
> >
> > I would like suggestions on setup of the heartbeat configuration files.
> > Pointers on the iptables startup script. and advice on what kernel
version
> > to use and if any patches need to be applied.
> >
> > Thanks in advance,
> >
> > Chip
> >
> >
> >
> >
> > Chip Upsal
> > SysAdmin
> > CyberWolf Inc
> >
> >
> >
> >
> >
>

RE: Using heartbeat for fall over on IPTables Firewall

[Cedric Blancher]

Le lun 17/03/2003 à 23:08, Steve Mickeler a écrit :
> Just off the top of my head:
> 1) heartbeat is limited to 2 nodes
> 2) keepalived config is much cleaner and easier to manage.

Moreover, keepalived supports VRRP, which means it can interoperate with
other devices that support this protocole and is far more flexible in
terms of configuration. It also supports IPSEC-AH authentication, as
defined in VRRPv2.

VRRP has been defined to provide flexible failover for routers, and is
so applicable to packet filters. In this usage, it is to my mind much
efficient than heartbeat.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
IT systems and networks security expert  - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE