D. Gwynne, Active-Active Firewall Cluster Support in OpenBSD

David Gwynne, Active-Active Firewall Cluster Support in OpenBSD, AsiaBSDCon2009:
The OpenBSD UNIX-like operating system has developed several technologies that make it useful in the role of an IP router and packet filtering firewall. These technologies include support for several standard routing protocols such as BGP and OSPF, a high performance stateful IP packet filter called pf, shared IP address and fail-over support with CARP (Common Address Redundancy Protocol), and a protocol called pfsync for synchronization of the firewalls state with firewalls over a network link. These technologies together allow the deployment of two of more computers to provide redundant and highly available routers on a network.

However, when performing stateful filtering of the TCP protocol with pf, the routers must be configured in an active-passive configuration due to the current semantics of pfsync. ie, one host filters and routes all the traffic until it fails, at which point the backup system takes over the active role. It is possible to configure these computers in an active-active configuration, but if a TCP session sends traffic over one of the firewalls and receives the other half of the connection via the other firewall, the TCP session simply stalls due to a combination of pfs stateful filtering and pfsync being too slow to cope.

This report documents the protocol and implementation changes made to pfsync which allows stateful filtering with OpenBSD routers in active-active configurations.

Category:

Science & Technology

Tags:

• OpenBSD
• BSD
• Firewall
• PF
• AsiaBSDCon
• AsiaBSDCon2009

[davidgwynne1]

wow, my name is also David Gwynne. yaaay!