Chapter 17: Firewall High Availability

In this chapter, we will learn how to configure high availability by connecting two firewalls to sync configuration, connect states, and preserve network connectivity if something goes wrong with one of our firewalls. By the end of this chapter, you will understand the concepts surrounding high availability and be able to implement them using OPNsense.

In this chapter, we will cover the following topics:

• High availability concepts
• Configuring high availability
• Testing the HA configuration

Technical requirements

You will need two running OPNsense installations on the same network to follow the steps in this chapter. Good knowledge of how to configure OPNsense networking and firewall rules is mandatory.

High availability concepts

Let's introduce this topic with an aviation example. At the beginning of heavier-than-air history, airplanes had just one engine to fly from one location to another. As aviation grew, the demand for long-range flights increased, and new projects that used two or more engines began. Nowadays, it is possible to cross the oceans with a twin-engine plane thanks to reliable engine technology and the Extended-range Twin-engine Operations Performance Standards (ETOPS). But even with all this technology, two engines are required to keep a long-haul flight within safety standards. Developments similar to the aviation industry also happened in the IT world – redundancy standards/protocols were created to keep the availability of the systems at acceptable levels for the business.

In OPNsense, the Common Address Redundancy Protocol (CARP) is a protocol that ensures that the network interfaces of two or more firewalls keep operating in case of a hardware...

Configuring high availability

First, let's look at the high availability scenario topology shown in the following diagram:

Figure 17.1 – A high availability topology example

In the preceding diagram, we have two OPNsense firewalls connected using a dedicated network interface. This interface, which we will call the HA Interface, is the network interface that will keep the firewall states synchronized using the pfsync protocol. We also use it to run XMLRPC to sync OPNsense 1's (master node) configuration to OPNsense 2 (backup node).

Proposed scenario

You can quickly reproduce this scenario using VirtualBox while configuring the network and the virtual machines using the steps we learned about in the previous chapters of this book (modifying the steps according to your lab environment).

First, configure two OPNsense firewalls, add a network interface (both from OPNsense), and connect them directly using a network interface that we will...

Testing the HA configuration

Now that we have both OPNsense firewalls up and running and configured with high availability, let's do some testing!

First, check if the virtual IPs are working accordingly on both OPNsense firewalls, as shown in the following screenshot:

Figure 17.9 – OPNsense-1 (master) running the CARP virtual IP

On both firewalls, you can check the virtual IP's status in the webGUI. Go to Interfaces | Virtual IPs | Status:

Figure 17.10 – OPNsense-2 (backup) running the CARP virtual IP

If you want to use a DHCP server on the LAN interface, you will need to make some configuration adjustments, as follows:

• Go to Services | DHCPv4 | LAN and set the following settings on the master node:
  • Set both the DNS servers and Gateway fields to the CARP LAN virtual IP; that is, 192.168.0.1.

Remember that every time you change the configuration on the master node, you must sync to...

Summary

In this chapter, you learned how OPNsense implements high availability to guarantee enterprise-grade availability as a firewall solution. We explored how the CARP protocol provides a cluster virtual IP operation and that when combined with pfsync, XMLRPC brings a complete stack for a firewall high availability cluster. Now, you can build solid and highly available firewall clusters using OPNsense that can survive a hardware failure and keep the networks safe and protected. In the next chapter, we will learn how to protect websites and web applications using OPNsense.