Disaster Recovery and Failover

Disaster Recovery and Failover

High-traffic sites require sophisticated failover mechanisms to maintain availability during firewall failures:

#!/bin/bash
# Automated failover system for firewall clusters

CLUSTER_NODES=("fw1.example.com" "fw2.example.com" "fw3.example.com")
VIP="203.0.113.10"
HEALTH_CHECK_INTERVAL=5
FAILURE_THRESHOLD=3

check_firewall_health() {
    local node=$1
    
    # Check firewall process
    ssh $node "systemctl is-active firewall" &>/dev/null || return 1
    
    # Check connectivity
    timeout 2 nc -zv $node 443 &>/dev/null || return 1
    
    # Check resource usage
    local cpu_usage=$(ssh $node "top -bn1 | grep 'Cpu(s)' | awk '{print \$2}' | cut -d'%' -f1")
    if (( $(echo "$cpu_usage > 90" | bc -l) )); then
        return 1
    fi
    
    return 0
}

promote_backup_node() {
    local failed_node=$1
    local new_master=""
    
    # Find healthy node
    for node in "${CLUSTER_NODES[@]}"; do
        if [[ "$node" != "$failed_node" ]] && check_firewall_health "$node"; then
            new_master=$node
            break
        fi
    done
    
    if [[ -z "$new_master" ]]; then
        echo "CRITICAL: No healthy firewall nodes available!"
        return 1
    fi
    
    echo "Promoting $new_master as new master"
    
    # Move VIP to new master
    ssh $failed_node "ip addr del $VIP/32 dev eth0" 2>/dev/null
    ssh $new_master "ip addr add $VIP/32 dev eth0"
    
    # Update BGP announcements
    ssh $new_master "/usr/local/bin/announce-vip.sh $VIP"
    
    # Sync state from failed node if possible
    timeout 30 ssh $failed_node "iptables-save" | ssh $new_master "iptables-restore" 2>/dev/null
    
    return 0
}

# Main monitoring loop
declare -A failure_counts
while true; do
    for node in "${CLUSTER_NODES[@]}"; do
        if check_firewall_health "$node"; then
            failure_counts[$node]=0
        else
            ((failure_counts[$node]++))
            
            if [[ ${failure_counts[$node]} -ge $FAILURE_THRESHOLD ]]; then
                echo "Node $node has failed health checks"
                promote_backup_node "$node"
                failure_counts[$node]=0
            fi
        fi
    done
    
    sleep $HEALTH_CHECK_INTERVAL
done

High-traffic websites demand firewall configurations that go beyond basic security to address performance, scalability, and availability challenges. By implementing distributed architectures, intelligent traffic management, and sophisticated monitoring systems, these advanced configurations ensure that security measures enhance rather than hinder website performance. The key to success lies in continuous optimization based on real-world traffic patterns and evolving threat landscapes, creating a dynamic security posture that adapts to meet the demands of millions of users while maintaining robust protection against increasingly sophisticated attacks.## Types of Firewalls for Web Servers - Network vs Application Layer

The landscape of firewall technology offers multiple approaches to protecting web servers, each with distinct capabilities, advantages, and ideal use cases. Understanding the different types of firewalls available helps you select the right solution—or combination of solutions—for your specific security requirements. This chapter explores the major firewall categories, comparing their features, performance characteristics, and deployment scenarios to help you make informed decisions about web server protection.