Loadbalancing Active Passive

Keepalived VRRP Setup with Health Checks for IPVSADM and HAProxy

In high-availability network architectures, active-passive load balancing guarantees service uptime by maintaining a standby node that immediately takes over if the primary node fails.

Combining Keepalived (using VRRP) with IPVSADM (Layer 4) or HAProxy (Layer 7) allows you to build a failover-capable entry point backed by dynamic, automated health monitoring.

Active-Passive Load Balancing Architecture

An active-passive cluster relies on two load balancer nodes sharing a single Virtual IP (VIP).

Primary (Active) Node: Owns the VIP, receives incoming traffic, and forwards requests to the backend pool.
Secondary (Passive/Standby) Node: Continuously monitors the health of the primary node over the network via VRRP heartbeats. It remains idle regarding client traffic.
Failover Event: If the primary node crashes or fails its internal service health checks, the passive node claims the VIP via Gratuitous ARP and begins handling traffic seamlessly.

VRRP Overview with Keepalived

The Virtual Router Redundancy Protocol (VRRP) governs IP failover by allowing a group of hosts to maintain a shared virtual address.

Heartbeat Mechanism: The primary node broadcasts VRRP multicast packets at regular intervals (typically 1 second) to 224.0.0.18.
Priority Election: Nodes are assigned a priority (e.g., 101 for MASTER, 100 for BACKUP). The host with the highest active priority binds the VIP.
Tracking Scripts: Keepalived can execute health check scripts locally. If a service (like HAProxy or IPVSADM) drops, Keepalived dynamically lowers its node priority, forcing a VIP failover even if the host server itself remains online.

Keepalived + HAProxy (Layer 7 Active-Passive)

When combining HAProxy with Keepalived, Keepalived manages the floating VIP, while HAProxy handles application-aware Layer 7 traffic routing and backend health probes.

HAProxy Health Check Script

To prevent Keepalived from holding the VIP when HAProxy crashes, create a lightweight tracking script:

#!/bin/bash
# /etc/keepalived/check_haproxy.sh
/usr/bin/killall -0 haproxy

vrrp_script check_haproxy {
    script "/etc/keepalived/check_haproxy.sh"
    interval 2
    weight 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 101
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass SecretClusterPass
    }

    virtual_ipaddress {
        192.168.1.100/24
    }

    track_script {
        check_haproxy
    }
}

Note: On the Backup node, set state BACKUP and priority 100.

Keepalived + IPVSADM / LVS (Layer 4 Active-Passive)

For ultra-fast Layer 4 transport-level balancing, Keepalived natively integrates with the Linux Virtual Server (LVS) kernel module, managing ipvsadm routing rules and backend health checks directly.

Integrated Keepalived + IPVS Configuration

Unlike HAProxy, Keepalived can natively probe IPVS backend real servers using TCP_CHECK or HTTP_GET blocks without external bash scripts.

vrrp_instance VI_LVS {
    state MASTER
    interface eth0
    virtual_router_id 52
    priority 101
    advert_int 1

    virtual_ipaddress {
        192.168.1.100/24
    }
}

# Virtual Server configuration for IPVS
virtual_server 192.168.1.100 80 {
    delay_loop 6
    lb_algo rr
    lb_kind NAT
    protocol TCP

    # Real Backend Server 1
    real_server 192.168.1.11 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            retry 3
            delay_before_retry 2
        }
    }

    # Real Backend Server 2
    real_server 192.168.1.12 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            retry 3
            delay_before_retry 2
        }
    }
}

Verifying IPVSADM Routing

Once Keepalived starts on the master node, verify that LVS has populated the kernel routing table:

ipvsadm -Ln

Verification and Failover Testing

Verify VIP Assignment: Run ip addr show eth0 on the Master node to confirm 192.168.1.100 is bound.
Simulate Service Failure: Stop HAProxy or block TCP ports on the Master node.
```
systemctl stop haproxy
```
Observe VIP Migration: Run ip addr show eth0 on the Backup node. The VIP should migrate instantly, keeping the load balancing endpoint accessible without manual intervention.