Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an intern network of servers. In this intern network only one server has access to the internet and serves as route/firewall so that other server have also access to internet.

Now we want to duplicate our firewall because if he crashes we can not access to any of our server.

Is there any easy way to failover the gateway in the interface of our intern server?

My first thought was to make a script to change the gateway from /etc/networking/interface and then restart networking. But it's not really reliable.

Is there something like first and second entry of DNS applicable to ip forward/route?

share|improve this question
Thanks :) Is the same result possible without any other software than a standard debian? – charles Mar 31 '14 at 16:03
As Matt's answer says, keepalived is the simplest way as it covers a lot of the management but IPVS has been included in the kernel since 2.4.something. You probably still need to add the admin tools to use a VRRP address. I've never tried it without keepalived though. – Matt Apr 1 '14 at 7:28

The easiest approach for your situation is to use keepalived which is an implementation of VRRP.

Install it in Debian Linux on each firewall with:

sudo apt-get install keepalived

Then edit the file /etc/keepalived/keepalived.conf

For the master (something like):

vrrp_instance default-gw {
  state MASTER
  virtual_router_id 1
  interface eth1
  priority 100
  authentication {
    auth_type pass
    auth_pass pass1234
  virtual_ipaddress {
     x.x.x.x/xx label eth0:pub
     y.y.y.y/yy label eth1:lan

And the slave config will be the same except with

state SLAVE
priority 101

I may have the config slightly wrong (I just butchered what I had which doesn't have the public side set up with a failover address but two separate addresses), but that's the essence of it. What it does is create a couple of virtual IP address. Where eth0:pub will be the public one and eth1:lan will be the private one.

If one host goes down, the other takes over.

There are a bunch of examples that you'll find under /usr/share/doc/keepalived/samples It's quite a powerful tool with quite a few features. You can even load-balance servers. Unfortunately, the website and documentation on the website hasn't kept pace with the product development so you may find some documentation examples don't work right. I've always found answers for it by googling.

If you're using NAT there is also a product to take over the in memory states. You may or may not need it. But that requires a third networking interface.

share|improve this answer

I would suggest using CARP as the answer. Unfortunately it's major implementations are in the BSD family and has not yet made it into the mainstream linux distros like debian. However, you can somewhat approximate the behavior of CARP using conn-track-tools in conjunction with iptables. Here's a HOW-TO that doesn't require anything more than software freely available in Debian. [1]

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.