How to Build a High‑Availability LVS Cluster with Keepalived and VRRP

Introduction

VRRP (Virtual Router Redundancy Protocol) creates a virtual router with a real IP and MAC address that client hosts use as their default gateway. The active router answers client requests, and when it fails, a backup router takes over, providing seamless failover.

keepalived Overview

keepalived implements VRRP as a daemon on Linux, generates IPVS rules from its configuration, performs health checks on real servers, and automatically adds or removes them from the IPVS pool.

Installation Environment

Three nodes are used:

node1 (172.16.2.14/24) – keepalived master/backup

node2 (172.16.2.13/24) – keepalived backup/master

node3 (172.16.2.12/24) – web server

Virtual IP: 172.16.2.15/24

Install keepalived

# yum -y install keepalived

Configure keepalived on node1

global_defs {
    notification_email {
        [email protected]
        [email protected]
    }
    notification_email_from [email protected]
    smtp_server 127.0.0.1
    smtp_connect_timeout 30
    router_id LVS_DEVEL
}

vrrp_instance mylinux_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 98
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 111122233334444
    }
    virtual_ipaddress {
        172.16.2.15/24 dev eth0 label eth0:0
    }
    virtual_routers {
        172.16.2.15/24 dev eth0:0
    }
}

virtual_server 172.16.2.15 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 10
    protocol TCP
    sorry_server 127.0.0.1
    real_server 172.16.2.12 80 {
        weight 1
        HTTP_GET {
            url {
                path /
                status_code 200
            }
        }
        connect_timeout 3
        nb_get_retry 3
        delay_before_retry 3
    }
}

Configure keepalived on node2

global_defs {
    notification_email {
        [email protected]
        [email protected]
    }
    notification_email_from [email protected]
    smtp_server 127.0.0.1
    smtp_connect_timeout 30
    router_id LVS_DEVEL
}

vrrp_instance mylinux_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 111122233334444
    }
    virtual_ipaddress {
        172.16.2.15/24 dev eth0 label eth0:0
    }
    virtual_routers {
        172.16.2.15/24 dev eth0:0
    }
}

virtual_server 172.16.2.15 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 10
    protocol TCP
    sorry_server 127.0.0.1
    real_server 172.16.2.12 80 {
        weight 1
        HTTP_GET {
            url {
                status_code 200
            }
        }
        connect_timeout 3
        nb_get_retry 3
        delay_before_retry 3
    }
}

Set up the web server on node3

# yum -y install httpd
# echo "<h1>test keepalived</h1>" > /var/www/html/index.html
# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
# ifconfig lo:0 172.16.2.15 broadcast 172.16.2.15 netmask 255.255.255.255 up
# route add -host 172.16.2.15 dev lo:0
# /etc/init.d/httpd start

Start keepalived and test

# /etc/init.d/keepalived start; ssh node2 '/etc/init.d/keepalived start'
# ip addr show 172.16.2.15
# ipvsadm -Ln
# curl http://172.16.2.15

Resulting screenshots show the virtual IP, IPVS table, and successful HTTP response.

Advanced: Custom health‑check scripts

Sample scripts can be placed in /usr/share/doc/keepalived-1.2.13/samples/ and referenced in the configuration:

vrrp_script chk_nginx {
    killall -0 nginx
    interval 1
    weight -5
}

vrrp_script chk_haproxy {
    killall -0 haproxy
    interval 1
    weight -5
}

vrrp_script chk_keepalived_down {
    [[ -f /etc/keepalived/down ]] && exit 1 || exit 0
    interval 1
    weight -5
}

track_script {
    chk_nginx
    chk_haproxy
    chk_keepalived_down
}

These scripts adjust the node’s weight based on service health, providing finer‑grained failover control.