Iptables - High availability
Published: 2020-06-09 14:04:56

                                 192.168.8.45(vrrp.ext.munnar.com)
                                             |
                                             |
                  _________________________________________________________
                 |                                                         |
                 |                                                         |
    192.168.8.133(ext.ipt1.munnar.com)                         192.16.8.132(ext.ipt2.munnar.com)

    ..................................                         .................................
    |192.168.57.3(ha.ipt1.munnar.com)|<<<------<<--->>------>>>|192.168.57.4(ha.ipt2.munnar.com)|
    ..................................                         .................................



    192.168.56.103(internal.ipt1.munnar.com)                   192.168.56.102(internal.ipt2.munnar.com)
                 |                                                         |
                 |                                                         |
                  _________________________________________________________
                                            |
                                            |
                               192.168.56.100(vrrp.internal.munnar.com)

**Scenario** HA Firewall placed between internal and external network as you can assume it's multi homed. And controls access from external network to services hosted in internal networks.     
       We have dedicated VRRP placed on both networks, systems in external network have to set the external VRRP(vrrp.ext.munnar.com) as default gateway or have to use static route for destined internal network via external VRRP. 
             The same needs to be done from internal network as well for return traffic(in our scenario), systems in internal network needs to use either vrrp.internal.munnar.com as default gateway or need to use static route for external destination via vrrp.internal.munnar.com.

**Network Configuration**

| Primary  |  Secondary |
|---|---|
|host1:ipt1.munnar.com(Primary)|host2:ipt2.munnar.com(Secondary)|
|ha.ipt1.munnar.com|ha.ipt2.munnar.com|
|ext.ipt1.munnar.com|ext.ipt2.munnar.com|
|vrrp.ext.munnar.com|vrrp.ext.munnar.com|
|int.ipt1.munnar.com|int.ipt2.munnar.com|
|vrrp.internal.munnar.com|vrrp.internal.munnar.com|

**Packages Required**

keepalived - for VRRP
contrack-tools - Firewall session synchronization between firewalls
iptables-services - iptables startup package

**Installation Steps**

`yum install iptables-services keepalived conntrack-tools -y`

####VRRP configuration

As depicted in the top layout, we are using two vrrp's one for external and another one for internal. The host ipt1.munnar.com acts as MASTER and ipt2.munnar.com is Backup.  

######Master Keepalived
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/pnuzl6pe4g9lozkk3hm9.png)

######Backup Keepalived
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/s1qsmmcikt86m20r7st0.png)

####Conntrackd Configuration

Conntrackd is used to synchronize the existing firewall sessions thereby maintains ongoing connections during failover.
       ha.ipt1.munnar.com and ha.ipt2.munnar.com are the dedicated interfaces used to sync the sessions. We need to copy two key files of conntrackd for configuration, copy /usr/share/doc/conntrack-tools-1.4.4/doc/sync/ftfw/conntrackd.conf as /etc/conntrackd/conntrackd.conf `cp /usr/share/doc/conntrack-tools-1.4.4/doc/sync/ftfw/conntrackd.conf /etc/conntrackd/conntrackd.conf`and copy /usr/share/doc/conntrack-tools-1.4.4/doc/sync/primary-backup.sh to /etc/conntrackd/ `/usr/share/doc/conntrack-tools-1.4.4/doc/sync/primary-backup.sh /etc/conntrackd/` and set executable bit.
            Following screen-shots shows the minimal configuration required to use conntrackd.

######ipt1 conntrackd
![ipt1 conntrackd](https://dev-to-uploads.s3.amazonaws.com/i/p8hr3o9w5dlbbrzocr04.png)

######ipt2 conntrackd
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/m8budsf3s4ejtfhes1kf.png)

Note: Conntrackd content is stripped to accommodate the content 

Further we need to enable packet forwarding on both of our firewalls `sysctl -w net.ipv4.ip_forward=1`,make sure to set this in /etc/sysctl.conf to make persistent across reboots. And iptables need to have access rule configured in forward chain of Filter table in order to pass the traffic between source and destination. 
             In my case I have a webserver running in internal network(192.168.56.107) and a client machine running in external network, hence I have added the following rules for accessing http from client machine.

`iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT`
`iptables -A FORWARD -d 192.168.56.107/32 -p tcp -m tcp --dport 80 -j ACCEPT`

 All configuration can be found in [github](https://github.com/karthiksedoc/HA-iptables)