Learn Keepalived - Secure Traffic Handling

#Introduction

Building HA without thinking about traffic security is like leaving the front door open and putting the alarm in the bedroom. Episode 13 secures the traffic paths around Keepalived: firewall rules for the VIP, defenses against IP spoofing, and hardening of health check endpoints.

We'll write nftables and iptables rules that only allow traffic that should exist, configure sysctl hardening like rp_filter and arp_filter, and make sure the /healthz endpoint doesn't become an easily exploitable entry path. By the end of this episode, your HA is resilient from the network side.

#Firewall for the Virtual IP

#Basic iptables Rules for the VIP

Start with rules that only open the service ports on the VIP:

sudo iptables -A INPUT -d 192.168.1.100 -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -d 192.168.1.100 -j DROP
sudo iptables -A INPUT -p vrrp -d 224.0.0.18 -j ACCEPT

The iptables -A INPUT -d 192.168.1.100 command opens the service port specifically for the VIP, and the last line allows VRRP packets destined for multicast 224.0.0.18. Without the VRRP rule, two nodes won't hear each other's advertisements.

#Equivalent nftables Rules

If you use nftables, the equivalent rules are more concise:

sudo nft add table inet filter
sudo nft add chain inet filter input '{ type filter hook input priority filter; policy accept; }'
sudo nft add rule inet filter input ip daddr 192.168.1.100 tcp dport 80 accept
sudo nft add rule inet filter input ip daddr 192.168.1.100 drop
sudo nft add rule inet filter input ip protocol vrrp ip daddr 224.0.0.18 accept

The nft add rule inet filter input ip daddr 192.168.1.100 tcp dport 80 accept rule opens port 80 on the VIP, and the VRRP line allows advertisements. Make sure the rules persist with nft list ruleset > /etc/nftables.conf.

#Preventing IP Spoofing

#Reverse Path Filtering

The Linux kernel can reject packets arriving from a direction that doesn't match the routing table. Enable rp_filter:

echo "net.ipv4.conf.all.rp_filter = 1" | sudo tee -a /etc/sysctl.d/99-security.conf
echo "net.ipv4.conf.default.rp_filter = 1" | sudo tee -a /etc/sysctl.d/99-security.conf
sudo sysctl -p /etc/sysctl.d/99-security.conf

net.ipv4.conf.all.rp_filter = 1 rejects packets whose source address is inconsistent with the return route, blocking many basic forms of spoofing.

#Securing ARP for the VIP

In multi-node scenarios, prevent two nodes from answering ARP for the VIP at the same time:

echo "net.ipv4.conf.all.arp_filter = 1" | sudo tee -a /etc/sysctl.d/99-security.conf
sudo sysctl -p /etc/sysctl.d/99-security.conf

net.ipv4.conf.all.arp_filter = 1 makes an interface answer ARP only if the address genuinely belongs to it on that interface. This stops the BACKUP node from answering ARP for a VIP currently held by another node.

#Validating Unicast VRRP

For networks without safe multicast, restrict VRRP to known nodes only. Use unicast_peer as in episode 9 and block incoming VRRP multicast from other interfaces, so advertisements can't come from a foreign node.

#Securing Health Check Endpoints

#Health Checks Exposed Only for Monitoring

The /healthz endpoint is often exposed too broadly. Restrict its access to Keepalived nodes only:

sudo iptables -A INPUT -d 10.0.0.11 -p tcp --dport 8080 -s 192.168.1.10 -j ACCEPT
sudo iptables -A INPUT -d 10.0.0.11 -p tcp --dport 8080 -j DROP

The iptables -A INPUT -s 192.168.1.10 rule only allows health checks from the HA node IP, then drops other requests. The monitoring endpoint is no longer a public door.

#Auth on the Health Endpoint

If possible, give the health check endpoint authentication so only authorized parties can trigger it. The application can check a header or a simple token, and Keepalived sends it via HTTP_GET:

real_server 10.0.0.11 8080 {
  weight 1
  HTTP_GET {
    url {
      path /healthz
      status_code 200
    }
    connect_timeout 3
    nb_get_retry 3
  }
}

The HTTP_GET block verifies that /healthz returns 200. If the endpoint needs a token, pass it through an environment variable on a custom health check script — don't put tokens in configuration stored in Git.

#Firewall on the Other Service Side

Don't forget the backend side. Firewall rules must be consistent in both directions: Keepalived protects the VIP from the outside, and the backend protects itself from unknown access. Make sure only the service subnet and the management subnet can reach the application ports, and that all HA nodes only accept the connections they actually need to perform their role.

#Closing

Episode 13 makes your HA hard to penetrate from the network direction: a firewall that only opens what's needed for the VIP, rp_filter rejecting spoofing, ARP that doesn't leak the VIP to the wrong node, and locked-down health check endpoints.

Key takeaways:

• Always allow VRRP packets, multicast or unicast, in the firewall.
• rp_filter rejects spoofed packets inconsistent with routing.
• arp_filter prevents the BACKUP node from answering ARP for another node's VIP.
• Restrict health check endpoints to HA node IPs only.
• Add authentication to the /healthz endpoint where possible.
• Keep health check tokens in the environment, not in config files.

In episode 14 next, we cover distributed HA architectures — comparing active-active and active-passive topologies, Keepalived with many load balancer nodes, IPVS connection synchronization, and failover considerations for stateful services.