Keepalived VRRP for HAProxy: Virtual IP Failover Setup

A single HAProxy instance is a single point of failure. Keepalived runs the VRRP protocol on Linux to float one virtual IP (VIP) between two load balancers: the MASTER holds the VIP and answers traffic; when it dies — server crash, lost link, or HAProxy itself failing — the BACKUP takes the VIP over in one to three seconds and clients never notice. This guide builds a complete two-node keepalived + HAProxy failover pair on Ubuntu.

Architecture

Clients -> VIP 10.0.0.10
             |
      +------+-------+
      |              |
  lb01 (MASTER)   lb02 (BACKUP)
  10.0.0.11       10.0.0.12
      +-------+------+
              |
        web1 / web2 backends

VRRP needs both nodes on the same L2 segment (failover relies on ARP and multicast 224.0.0.18, IP protocol 112). Keepalived does not load balance — only one node owns the VIP; HAProxy still balances across the backend pool.

Step 1: HAProxy Configuration on Both Nodes

sudo apt install haproxy -y

Both nodes run the same config. HAProxy binds to the VIP, which the BACKUP does not own yet — allow binding to non-local addresses or HAProxy will refuse to start there:

frontend fe_main
    bind 10.0.0.10:80
    default_backend be_web

backend be_web
    balance roundrobin
    server web1 10.0.0.21:80 check
    server web2 10.0.0.22:80 check

echo "net.ipv4.ip_nonlocal_bind = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Step 2: Keepalived Configuration — Master (lb01)

The vrrp_script is what makes failover react to HAProxy dying, not just the host:

global_defs {
    router_id lb01
}
vrrp_script chk_haproxy {
    script "kill -0 $(cat /var/run/haproxy.pid)"
    interval 2
    weight -20
    fall 3
    rise 2
}
vrrp_instance VI_1 {
    state MASTER
    interface ens3
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass Secret01
    }
    virtual_ipaddress {
        10.0.0.10/24
    }
    track_script {
        chk_haproxy
    }
}

Step 3: Backup Node (lb02)

Identical except state BACKUP and a lower priority. Both nodes keep the same virtual_router_id and auth password — any mismatch and the pair never elects:

vrrp_instance VI_1 {
    state BACKUP
    interface ens3
    virtual_router_id 51
    priority 90
    ...
    virtual_ipaddress { 10.0.0.10/24 }
    track_script { chk_haproxy }
}

Also enable IP forwarding for good measure on both nodes, then start the services:

sudo systemctl enable --now keepalived haproxy

Verification and Failover Test

ip addr show ens3 | grep 10.0.0.10
systemctl status keepalived
journalctl -u keepalived -f

sudo systemctl stop haproxy      # on the MASTER

Within a few seconds the BACKUP's health-check script fails on the master, the master's VRRP priority drops below the backup's, and the VIP appears on lb02 — verify with ip addr on both nodes and by continuing to reach the VIP over HTTP. Start the old master and (with preemption, the default) the VIP returns to it.

HAProxy keepalived pairs mirror the first-hop redundancy ideas in Cisco HSRP configuration; for active-active Layer 2 designs see Dell OS10 VLT peer routing.

原文链接：https://perlod.com/tutorials/keepalived-vrrp-haproxy-failover