Description
We have established 10 internal VLANs connecting both router nodes with VRRP. Additionally, there is an external connection through a dedicated VLAN, where OSPF and load-balancing with border routers are implemented. The challenge lies in the lack of control over load-balancing for incoming packets through this external connection, resulting in their potential arrival at any of our router nodes. More details about our design are on the Forum page.

Objective
Our objective is to implement a stateful firewall configuration, allowing outgoing sessions to any IP while permitting the initiation of sessions from outside sources only from a predefined set of IPs.

Solution
Drawing inspiration from commercial firewalls like Palo Alto, VyOS 1.4 currently supports conntrack-sync only in alignment with the VRRP instance. Notably, in VyOS, multiple VRRP instances with distinct active/backup roles can exist on the same router in different instances. This suggests that conntrack-sync could potentially operate in a similar manner. The envisioned setup involves a Multiprimary setup marking each router as the session owner, sending owned sessions to the peer, and accepting only sessions owned by the HA partner. As per documentation, Multiprimary setup is supported by conntrackd on Debian 8 but not yet supported in VyOS 1.4.

Concerns:

1. VyOS HA Conntrack-Sync is Unidirectional:
   • Conntrack-sync in VyOS HA configuration is observed to be unidirectional (Primary-Backup), limiting synchronization possibilities. The service conntrack-sync does not support multiple instances and allows configuration for only a single instance (documentation reference). Is it feasible to establish multiple unidirectional sync instances in VyOS?
2. Bidirectional Sync with Native Conntrackd:
   • A key inquiry is whether it is practical to have multiple unidirectional sync instances (e.g., A to B and B to A) or utilize a native Multiprimary setup of the conntrackd utility in VyOS. The goal is to enhance flexibility and establish a bidirectional synchronization setup by having multiple conntrack-sync instances.

Conntrackd Documentation and Implementation:

1. Feasibility Check:
   • Requesting verification of the feasibility of bidirectional synchronization for conntrack-sync in an active-active HA configuration.
   • If feasible, guidance or step-by-step instructions on configuring such a bidirectional setup would be greatly appreciated.
2. Conntrackd Documentation Interpretation:
   • Seeking assistance in interpreting conntrackd documentation, specifically in the context of its support for Multiprimary setups within VyOS 1.4 (documentation reference).
   • Additionally, insights into leveraging conntrackd to achieve bidirectional synchronization are appreciated.

Your attention to these inquiries is invaluable, and any insights or guidance you can provide will greatly assist in resolving our configuration challenges.