iptables fw redundancy

[revzalot]

Anyone have a good how to on this using two linux machines with iptables?

[phoenix]

You could hack something together using heartbeat (for failover), freevrrp (for sharing common IPs), and drbd (to replicate a block device between the two hosts). But (AFAIK) you won't be able to save/failover state between the two. You'll either have to use non-stateful rules, or put up with the possibility of dropping any existing connections during the fail-over.

[stukov]

Thanks phoenix, your post saves me. I was looking forward to building something similar. I'll post any updates I have here.

[revzalot]

Thanks buddy. Looks like OpenBSD/CARP is the ideal setup for fw redundancy.