I would like to ask the advice and tips of all you gurus out there.
We have two ccr routers in VRRP setup. The config is fairly static except for firewall rules which we work on quite a bit.
My thoughts, and I am asking you guys if I am mad / wasting my time to try this, is to built a script on the master that dumps the filter config to a file, say twice a day, and then the slave pulls that file and imports it?
Does this sound like something worth trying or are there demons ahead?
No, its not crazy This is something I have experimented with as well. There are multiple ways to do this now, but yes it can be done. The biggest problem is making sure that you are not duplicating rules/ actions as you import the script. Here is an example, its for Layer 7 matchers, but it shows how to find particular script entries and make sure that you are not duplicating those rules. http://www.mikrotik.com/download/l7-protos.rsc. Try useing ftp/tftp to move the files. Then use scheduler to process the file.
Regarding the point where the filter table would be empty when tables flushed, I see your concern, and it is valid. In theory this would only happen on the passive/inactive vrrp partner which has no / little traffic passing through.
I can picture some nasty situations where the active device fails partially / badly and this starts to happen on the new active host.
beside MikroTik we run a linux debian based loadbalancer with multipath routing and there we use “iptables -F” to flush rules for routing marks and set new ones as needed. We experienced no problems so far.
A better option would be some type of unified management platform whereby routers in a VRRP configuration could be managed as a single unit, obviating the need to manually sync all the settings from the master to the slave. Or an automated process whereby a slave unit auto-synchronizes to the master when VRRP is configured.
I’d suggest you guys give this a try: https://github.com/svlsResearch/ha-mikrotik
Full and automatic configuration sync, you manage one unit and the other one stands by as a slave.
It has been in production for about 4 months at 6 different sites.
This is something I have experimented with as well. There are multiple ways to do this now, but yes it can be done. The biggest problem is making sure that you are not duplicating rules/ actions as you import the script. Here is an example, its for Layer 7 matchers, but it shows how to find particular script entries and make sure that you are not duplicating those rules.