Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We use linux computer as our office gateway. It has two Internet connection and one LAN connection. My problem is that whenever there is any gateway software configuration problem or hardware problem, LAN clients looses internet connection. To solve this, I was thinking to create a cluster of two gateway PCs running same services(proxy,firewall,IDs etc) so that any one of them has problem, traffic can reach internet through the other gateway. I assume clustering gives single IP to all nodes in cluster so all LAN client will have cluster IP as their gateway. I would like to know any open source or free software which can do this on linux or if there is any better way of achieving the same.

Thanks in advance! Sanket

share|improve this question
up vote 1 down vote accepted

You want a layer 2 failover protocol.

The only open standard for this is VRRP; with VRRP you'd be able to use a cisco box and a checkpoint box as your failover targets and it would (should) work properly.

Vendors also typically have their own; cisco has HSRP, juniper(netscreen) has NSRP, openbsd and freebsd both have CARP.

You can do VRRP with linux.

Keep in mind that with many of these you're only making the default gateway for your subnet redundant. You may/will need to have some other mechanism to keep the firewall rules and configs and state tables (or not) in sync. Also, most of these protocols are active/standby style protocols.

share|improve this answer
Chris, Thanks for the reply. This exactly what I am looking for. I will look at various linux implementations of VRRP. – user7010 Aug 25 '09 at 14:43
CARP is an open standard as well. Certainly a Free and OpenBSD's carp implementation (should) work together, as should OpenBSD and linux running ucarp. – Cian Aug 25 '09 at 15:00
@cian: That's good to know. It's nice to have patent free L2 failover protocol. I'd still consider it to be in the same realm of semi-proprietary protocols as extreme networks's EAPS protocol -- it is documented and open but nobody uses it. The code is there for carp and it is BSD licensed, but it won't inter-operate with your ASA box. – chris Aug 25 '09 at 15:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.