Re:Big Update to OpenBSD's pfsync
by tremon on Thursday July 06, 2023 @10:14AM
(#36616116)
http://man.openbsd.org/pfsync has more details. This is interesting, I also didn't know of its existence. That said, I've never had to administer multiple failover firewalls so my interest is purely out of curiosity.
[ Parent
| on HN ]
Re:Big Update to OpenBSD's pfsync
by darkhelmet on Thursday July 06, 2023 @10:36AM
(#36616553)
"carp" should also be included in discoveries alongside pfsync. carp functions like cisco/juniper/etc VRRP to enable real-time failover. With pfsync being a stateful firewall a lot of care needs to happen with failovers. carp + pfsync allow you to run multiple hot pfsync firewalls that have synchronized state and have near-instant failover without state-related hiccups.
We use pf+pfsync+carp extensively over in FreeBSD.org as well. It's good stuff!