How to implement statefull firewall

ahmedken · 02-26-2007, 04:06 AM

I have sucecessfully implemented a set of linux servers to act as active/standby set of firewalls, using keepalived and VRRP, the problem the failover is stateless. Can you tell me how to implement statefull failover?

acid_kewpie · 02-26-2007, 04:14 AM

it looks like you want to look at the ct_sync module/project.

http://svn.netfilter.org/cgi-bin/vie...EADME?rev=4083
http://gnumonks.org/~laforge/weblog/...ync/index.html

ahmedken · 03-04-2007, 04:05 AM

Up Up Up Up

ahmedken · 03-04-2007, 04:08 AM

I think conntrackd should be implemented, but i have some issues with compiling the kernel and installing the conntrackd. I am wiating for your valuable helps

.

acid_kewpie · 03-04-2007, 05:20 AM

well, help with what? i've given you projects to look at and you're bumping without responding to them. to my knowledge conntrack is a standard part of iptables, but only relevant to stateful connections within a single netfilter instance. the replication of state tables between machines is actually going to be a seperate system which only deals with entries in a data structure, not specifically in a context of tcp connections and such.

ahmedken · 03-06-2007, 04:30 AM

Quote:

Originally Posted by acid_kewpie

well, help with what? i've given you projects to look at and you're bumping without responding to them. to my knowledge conntrack is a standard part of iptables, but only relevant to stateful connections within a single netfilter instance. the replication of state tables between machines is actually going to be a seperate system which only deals with entries in a data structure, not specifically in a context of tcp connections and such.

Please note that conntrackd is used to provide ha for linux firewalls. http://people.netfilter.org/pablo/conntrackd/