Firewall failover internal ip

Lennard K

7/11/24, 11:43 AM

I have multiple servers at my data center and i want to switch to pfsense, but i don't know if it can automatically fall over to the second server that is a mirror from the first server.

So if the first server crashed or is shut off pfsense must detect that it is no longer online and switch to the second server.

if pfsense cannot to this is there a firewall that can do it?

(I also like to know if pfsense or a other firewall can see which domain name is called and send for example s1.myserver.com to the first server and s2.myserver.com to the second server.)

1 + 2

domain-name-system

firewall

failover

pfsense

Zac67

7/11/24, 2:23 PM

Do you want failover for a server behind the pfSense or for the pfSense itself? Forwarding by HTTP host name requires setting up a reverse proxy.

HBruijn

7/12/24, 2:36 PM

**Note: Requests for product, service, or learning material recommendations are considered [**off-topic**](http://serverfault.com/help/on-topic) on serverfault.com. Wikipedia often has lists of available products such as https://en.wikipedia.org/wiki/List_of_router_and_firewall_distributions that gives a you an overview of alternatives that provide similar and different features compared to pfSense

Score:0

Server

HBruijn

7/12/24, 2:14 PM

Too long for a comment:

Your question is quite unclear due to you mixing technical terms, concepts and jargon and not using them correctly.

Strictly speaking pfsense is not just/only a firewall, but by default combines the functionality of router and firewall with a web-based front-end and that base functionality can relatively easily be extended by installing additional packages.

pfSense itself can be highly available: install two pfSense nodes that act as an “active/passive” cluster with the primary node working as the master node and the secondary node in a backup role, taking over as needed if the primary node fails. Both the configuration and settings as well as state can be replicated from the master to the backup, ensuring seamless failover. See: https://docs.netgate.com/pfsense/en/latest/highavailability/index.html

To provide high-availability and failover for your servers a typical solution is a load balancer and/or reverse-proxy.

pfSense can provide some forms of load balancing for your servers, typically by installing additional packages. The HAproxy package is a common choice.

Alternatively you can install HAproxy or similar software separately, rather than on your firewall/router appliance or get dedicated loadbalancer appliances.

A completely different method, that doesn't rely on an external load balancer or reverse proxy, is by for example joining your servers in a HA-cluster

As for your last question

I also like to know if pfSense or a other firewall can see which domain name is called and send for example s1.example.com to the first server and s2.example.com to the second server.

That can only be done with protocols to support including the hostname in the connection request (such as HTTP and HTTPS) as not all protocols support that. See:

How do I make protocol foo hostname aware?

For protocols that do support that: HAproxy or similar software can be configured to use the hostname in the request for such redirection, as can many other (reverse) proxy servers

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Firewall failover internal ip

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.