IP Fire HA cluster with Keepalived

Add-Ons
1

Dear all,
I want to use two IPFIRE boxes as HA-Cluster for redundancy. For this I found


What I do not really understand how this both boxes are synced on a regular basis, so that all configurations are the same and also all current DHCP leases are kept synchronous.
2

Hello @herby ,

if your network configuration allows it, have you also considered installing a dual-wan router (with eg load-balancing) because that would allow only one IPfire to be maintained ?

3

Most dual-wan routers are “boxed” firewall themselves…

4

My intention was more to have two separate modems and two separate hardware-boxes with IPFIRE. What I’m was looking for is how to keep the synced (e.g. DKCP…)

5

I am working a bit on this to do this with Corosync. Once i have something packed i will ask people to try this out.

6

Did anything happen since 5 years ago?
I’m almost finishing my HA Cluster. I will keep you guys posted, maybe create a github repo with all the instructions.
Thanks.

Regards.

7

I have a fairly extensive home automation setup, and I use Keepalived with DHCP failover to ensure that all of my IoT devices on the BLUE network remain connected at all times.

My configuration consists of two IPFire systems behind my ISP router:

  • IPFire on my primary PC, with a 10 Gbps connection for both the GREEN network and the BLUE network used for home automation.
  • IPFire2 on a Raspberry Pi 4B as a backup. It only provides failover for the BLUE network, while its GREEN interface is used exclusively for Wi-Fi access to the web interface (GUI).

This setup allows me to perform maintenance on the two firewalls without any interruption to devices on the BLUE network, thanks to DHCP failover.

I followed User Case 2 from the wiki:

with a few adaptations:

  • Sending email notifications via SMTP does not work on my IPFire systems, so I wrote a small script to send email notifications whenever the node changes from MASTER to BACKUP or vice versa.
  • The iptables rule for VRRP shown in firewall.local did not work in my configuration. I had to modify it so that it applies to the BLUE network.
  • I also had to add two sysctl commands to resolve a failover issue that occurred when the original MASTER resumed operation.

Finally, steps 5/6 and 6/6 in the wiki are no longer necessary, as the Keepalived service is automatically enabled during the add-on installation.

Regards.