conntrackd – conntrackd is the user-space daemon for the netfilter connection tracking system. This daemon synchronizes connection tracking states between several replica firewalls. Thus, conntrackd can be used to deploy highly available stateful firewalls.<\/p>\n
config file is in \/etc\/conntrackd\/conntrackd.conf<\/strong><\/p>\n Im gonna use FTFW mode for syncing between 2 routers.<\/p>\n Add this configuration at the end of config file in router1 and router2.<\/p>\n \nSync { UDP { On second node – router 2 IPv4_address<\/strong> and IPv4_Destination_Address<\/strong> shoud be opposite =><\/p>\n IPv4_address 10.100.200.2 and IPv4_Destination_Address 10.100.200.1<\/p>\n 3.Tuning some stuff example of script<\/p>\n #!\/bin\/bash Edit primary-backup.sh and add following line under “send a bulk update to backups”<\/p>\n logger “ERROR: failed to invoke conntrackd -B” And….<\/p>\n logger “ERROR: failed to invoke conntrackd -n” conntrackd – conntrackd is the user-space daemon for the netfilter connection tracking system. This daemon synchronizes connection tracking states between several replica firewalls. Thus, conntrackd can be used to deploy highly available stateful firewalls. config file is in \/etc\/conntrackd\/conntrackd.conf Im gonna use FTFW mode for syncing between 2 routers. Add this configuration at the end …<\/p>\n
\n Mode FTFW {
\n }<\/p>\n
\n IPv4_address 10.100.200.1
\n IPv4_Destination_Address 10.100.200.2
\n Port 3780
\n Interface eno3
\n SndSocketBuffer 1249280
\n RcvSocketBuffer 1249280
\n Checksum on
\n }
\n}<\/p><\/blockquote>\n
\nCreating simple script can be made to start\/stop anything when router1 and router2 switch.<\/p>\n
\ncase “$1” in
\n primary)
\n sleep 5 # give time to keepalive to wake up
\nip addr add 10.12.13.11\/24 dev eno4
\nsystemctl start openvpn
\nsystemctl start bgp
\nsystemctl do smethig else.
\n ;;
\n backup)
\nip addr del 0.12.13.11\/24 dev eno4
\nsystemctl start openvpn
\nsystemctl start bgp
\n ;;
\nesac<\/p><\/blockquote>\n
\n fi
\n\/etc\/keepalived\/script.sh primary<\/strong>
\n ;;
\n backup)<\/p><\/blockquote>\n
\n fi
\n\/etc\/keepalived\/script.sh backup<\/strong>
\n ;;
\n fault) <\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"