Two routers, and what must move
Pair two Debian 13 routers so the office survives one failing: keepalived VRRP for the gateway and public addresses, conntrackd so open connections survive, NAT to a shared address, health checks, and split brain, all measured in a lab.
By the end you will be able to:
- Share a LAN gateway and a public address between two Debian routers with keepalived
- Explain why open connections break in a failover, and keep them alive with conntrackd
- Choose NAT that survives a failover, and allow VRRP and sync traffic in nftables
- Add a health check that fails over when the ISP stops working, not just the router
- Recognise and fix split brain, preemption surprises and other failover problems
Prerequisites: Debian as an office router: interfaces, VLANs and a firewall
The router from Debian as an office router does everything an office needs, until it doesn't: a failed disk, a dead power supply, a kernel update that won't boot, and the whole office is offline. The fix is a second router, but two routers only help if failing over is automatic, and if the office doesn't notice.
Three things have to move from the failed router to the other one:
- The gateway address on the LAN. Every PC sends its internet traffic to one address, 10.10.10.1. It must keep answering, from whichever router is up.
- The public address on the WAN. The office's connections to the internet come from one public address, through NAT. Replies are sent back to that address, so it must move too.
- The connection table. A stateful firewall and NAT remember every connection. A router that takes over without that memory drops every connection that was already open.
VRRP (Virtual Router Redundancy Protocol) handles the first two: the routers share virtual addresses, and the one with the highest priority holds them, announcing itself every second. On Debian, keepalived implements it. conntrackd handles the third, copying each router's connection table to the other as connections come and go.
The lab
Two Debian 13 routers, r1 and r2, are built exactly like the router in the base lesson: systemd-networkd, the staff VLAN (10) on a trunk to the office switch, nftables with NAT. Here each has its own addresses (10.10.10.2 and .3 on the LAN, 203.0.113.2 and .3 on the WAN) and they share 10.10.10.1 and 203.0.113.4. A third link, a direct cable between them, carries the connection sync. A staff PC uses 10.10.10.1 as its gateway, and a web server on the internet runs a long-lived TCP stream: one line every 0.2 seconds, so any interruption is easy to see.
- r1 is master. r1 holds 10.10.10.1 and 203.0.113.4 and announces itself every second. The staff PC's traffic goes through it, NATed to the shared public address.
- Connections are copied. conntrackd sends every change in r1's connection table to r2 over the sync link, so r2 knows each open connection and its NAT translation.
- r1 fails. r2 misses three advertisements and takes both shared addresses. Pings recover in about 3.5 s; with sync, the open TCP stream pauses and carries on.