Hi,
I am building a 2-node cluster of bridging firewalls (filtering on br0
bridge device with no IP address configured). Instead of keepalived and
friends I am simply using Spanning Tree Protocol to fail over to slave
bridge and fail back to the master. This works great, 10-seconds of
switchover time is acceptable for me.
I want to have stateful firewall cluster, so that's why I am trying to
use conntrackd to sync state between the two nodes. It works when the
fail over occurs since the states are synced at that time (all the
states which are bound at the time when both nodes are up, show up on
both nodes). If the master node goes down, the STP does the switch and
since the states are in place, everything works fine. However, when the
master node comes back again, the STP does the failback, but the states
are not synced back to the master by conntrackd.
How to fix this? Is there any better, more "proper" way to make a
cluster of bridging firewalls?
Thanks,
Nejc
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
