state sync?

etfeet · Sep 30, 2020, 5:04 AM

Does tsnr support firewall/connection state sync between instances?
Looking through the documentation and I can't find anything that mentions how you would sync connection state between tsnr instances. ie highly available firewall deployment.

Derelict · Sep 30, 2020, 11:29 PM

No. There is nothing like that yet. It would generally only be an issue if NAT is in the mix.

etfeet · Oct 1, 2020, 10:05 PM

use case I'm looking at is using tnsr for a ha perimeter firewall deployment (including destination nat port forwarding and outbound nat masquerading). so keeping the nat state table in sync between router instances definitely a concern. Can you use regular Linux Contrack to keep the tables in sync? on regular centos/ubuntu/etc you can use this: https://conntrack-tools.netfilter.org/manual.html.