High-Availability VPN Cluster Deployment: Redundant Link Design with Keepalived and IPsec

Introduction

In modern enterprise networks, VPNs are critical for connecting remote sites and mobile users. However, a single point of failure can disrupt the entire VPN service, leading to business losses. By deploying a high-availability VPN cluster using Keepalived for virtual IP (VIP) failover and IPsec for encrypted tunnels, you can significantly enhance network reliability and security.

Architecture Design

Components

• Keepalived: Implements VRRP for VIP management and health checks. When the primary node fails, the backup node automatically takes over the VIP, ensuring service continuity.
• IPsec: Provides data encryption and authentication, supporting IKEv1/IKEv2 protocols for site-to-site or remote access scenarios.
• Cluster Nodes: At least two servers, configured as MASTER and BACKUP roles.

Network Topology

[Internet] <--> [VIP: 203.0.113.10] <--> [Node1 (MASTER): 10.0.0.1]
                                     <--> [Node2 (BACKUP): 10.0.0.2]

The VIP exposes the VPN service externally, while internal nodes communicate via private IPs. Keepalived monitors the IPsec process; upon primary failure, the VIP floats to the backup node.

Deployment Steps

1. Environment Preparation

• OS: Ubuntu 22.04 LTS or CentOS 7+
• Install packages: strongswan (IPsec) and keepalived
• Ensure network connectivity between nodes, and open UDP ports 500, 4500 (IPsec) and VRRP multicast address (224.0.0.18)

2. Configure IPsec

Edit /etc/ipsec.conf with connection parameters, for example:

conn site-to-site
    left=10.0.0.1
    leftsubnet=192.168.1.0/24
    right=203.0.113.20
    rightsubnet=192.168.2.0/24
    auto=start

Note: Both nodes should use the same IPsec configuration, but left should point to their respective actual IPs.

3. Configure Keepalived

Primary node /etc/keepalived/keepalived.conf:

vrrp_script chk_ipsec {
    script "/usr/bin/pgrep -x charon"  # Check strongSwan process
    interval 2
    weight -20
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1234
    }
    virtual_ipaddress {
        203.0.113.10/24 dev eth0
    }
    track_script {
        chk_ipsec
    }
}

Backup node configuration is similar, with state BACKUP and priority 90.

4. Start Services

systemctl enable strongswan keepalived
systemctl start strongswan keepalived

Verify VIP binding: ip addr show eth0.

Failover Testing

1. Stop IPsec on the primary node: systemctl stop strongswan
2. Check Keepalived logs: tail -f /var/log/syslog – you should see VIP moving to the backup node.
3. Attempt to connect to the VIP from a remote site and verify the VPN tunnel is established.

Optimization Tips

• Enhanced Health Checks: Beyond process checks, implement scripts that test IPsec tunnel connectivity.
• Session Synchronization: For stateful VPNs like IPsec, use connection sync mechanisms (e.g., strongSwan's charon-cmd) to avoid interrupting existing connections during failover.
• Monitoring and Alerting: Integrate with Prometheus or Nagios to monitor VIP status and IPsec tunnel counts.

Conclusion

Combining Keepalived with IPsec provides a cost-effective high-availability VPN cluster. This solution is suitable for small to medium enterprises, effectively mitigating single-node failures and ensuring stable remote access.

Related reading

• Multi-Path Redundancy and Intelligent Failover: A Practical Guide to Building High-Availability VPN Architectures