PF pf firewall and load balancer(s)

C

Cromulent

This is probably a stupid question but I'm looking for some advice on my plans.

The network I want is something similar to this:

firewall -> load balancer -> httpd

Now if the firewall server goes down it would mean that the entire network would be unavailable so I was curious if I could anycast the firewall IP address and then have multiple firewall servers to make sure the site stays up if one fails. The same would be true for the load balancer and the httpd server except anycast would not be required as I can set the internal IP addresses as I please in the pf config file.

I'd like to keep all the servers behind the firewall unable to connect directly to the internet so that if I wanted to SSH into them for example I'd have to login to the firewall server via SSH and then connect to the backend servers from there. Basically the firewall(s) would be the only machines with a public IP address.

I'm not sure if my plan is reasonable so I'd love to hear feedback from you.
 
This is how we set up our firewall/LBs at $JOB. The difference being that the firewall is actually two firewalls, the second of which takes over if the first one fails. We use Checkpoint firewalls and F5 LBs.

PF supports carp so running two firewalls in parallel is not a problem. The issue is failing over the IP from the primary to the secondary firewall. Ideally one would want to run the FreeBSD systems in an HA cluster. I don't know how to do that.

Regarding HA clusters, most will failover the IP but some, AIX, will also failover the MAC address. Either way you'd probably need to set up a single gateway to your ISP and insert your firewalls between the gateway and your LB.
 
Personally I would combine the firewall and load balancing (I prefer failover mostly) on the same machine.

firewall+lb A -> webserver A
firewall+lb B -> webserver B

And do failover with floating IPs on both firewalls and webservers.

carp(4)

man.freebsd.org man.freebsd.org
 
You must log in or register to reply here.
Back
Top