{"id":25883096,"url":"https://github.com/o-x-l/nftables_addon_failover","last_synced_at":"2025-08-02T11:08:09.760Z","repository":{"id":189326001,"uuid":"680467650","full_name":"O-X-L/nftables_addon_failover","owner":"O-X-L","description":"NFTables Addon for Failover variables ","archived":false,"fork":false,"pushed_at":"2024-12-24T11:38:17.000Z","size":39,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"latest","last_synced_at":"2025-03-02T16:38:31.358Z","etag":null,"topics":["failover","failover-ip","firewall","network","networking","nftables","nftables-sets"],"latest_commit_sha":null,"homepage":"https://docs.o-x-l.com/firewall/nftables.html","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/O-X-L.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-19T10:39:01.000Z","updated_at":"2024-12-24T11:38:21.000Z","dependencies_parsed_at":null,"dependency_job_id":"ef150458-1f90-4138-9c57-6669a47917c2","html_url":"https://github.com/O-X-L/nftables_addon_failover","commit_stats":null,"previous_names":["superstes/nftables_addon_failover","o-x-l/nftables_addon_failover"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/O-X-L/nftables_addon_failover","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_failover","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_failover/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_failover/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_failover/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/O-X-L","download_url":"https://codeload.github.com/O-X-L/nftables_addon_failover/tar.gz/refs/heads/latest","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/O-X-L%2Fnftables_addon_failover/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268378806,"owners_count":24240896,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-02T02:00:12.353Z","response_time":74,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["failover","failover-ip","firewall","network","networking","nftables","nftables-sets"],"created_at":"2025-03-02T16:31:13.721Z","updated_at":"2025-08-02T11:08:09.737Z","avatar_url":"https://github.com/O-X-L.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# NFTables Addon - Failover\n\nThis failover addon enables you to have one NFTables variable that will always point to a server that is online.\n\nWhy would you want that?\n\nIt's an alternative to using a load-balancer/reverse-proxy to perform a failover between nodes.\n\nMany times a central endpoint is a better solution - but if it is a high-traffic or low-latency application it might be smarter to send the traffic directly to the target node.\n\n\u003cimg src=\"https://github.com/superstes/nftables_addon_failover/blob/latest/docs/failover.png\" alt=\"Failover - Proxy/LB vs direct\" width=\"600\"/\u003e\n\nCurrently only TCP port-checks are supported.\n\nLinks: [NFTables Documentation](https://docs.o-x-l.com/firewall/nftables.html) |\n[Addon for DNS-Resolution](https://github.com/O-X-L/nftables_addon_dns) |\n[Addon for IP-Lists](https://github.com/O-X-L/nftables_addon_iplist)\n\n----\n\n## Install\n\n* Create directories:\n\n   ```bash\n   mkdir -p /var/local/lib/nftables_addons /etc/nftables.d/addons/\n   ```\n\n* Add the script-files:\n\n   * [util.py](https://github.com/O-X-L/nftables_addon_dns/blob/latest/lib/util.py)\n   * [iplist.py](https://github.com/O-X-L/nftables_addon_failover/blob/latest/lib/failover.py)\n\n* Add the config file:\n\n   `/etc/nftables.d/addons/failover.json`\n\n* Optional: Create a service user\n\n   * Add sudoers privileges\n   * Allow to read lib-dir\n   * Allow to write to addons-config-dir\n\n* Add cron or systemd-timer to execute the script on a schedule: `python3 /var/local/lib/nftables_addons/failover.py`\n\n* Test it and verify it's working as expected\n\n----\n\n## Result\n\n```text\ncat /etc/nftables.d/addons/failover.nft \n\u003e # Auto-Generated config - DO NOT EDIT MANUALLY!\n\u003e \n\u003e define endpoint_filer_v4 = 192.168.87.100\n\u003e define endpoint_filer_v6 = 2001:DB8:2:2\n\u003e define endpoint_print_v4 = 192.168.93.52  # if first one is offline\n\u003e define endpoint_print_v6 = ::\n\u003e define mark_proxy_v4 = 200\n\u003e define mark_proxy_v6 = ::  # unused\n```\n\n----\n\n## How does it work?\n\n1. A configuration file needs to be created:\n\n    `/etc/nftables.d/addons/failover.json`\n\n    ```json\n    {\n      \"failover\": {\n        \"endpoint_filer\": {\n          \"ip4\": [\"192.168.87.100\", \"192.168.87.101\"],\n          \"ip6\": [\"2001:DB8:2:2\", \"2001:DB8:2:3\"],\n          \"port\": 443\n        },\n        \"endpoint_print\": {\n          \"ip4\": [\"192.168.93.51\", \"192.168.93.52\"],\n          \"port\": 631\n        },\n        \"mark_proxy\": {  // set fwmark for policy routing\n          \"ip4\": [\"192.168.132.2\", \"192.168.132.3\"],\n          \"port\": 3129,\n          \"values\": [200, 201]\n        }\n      }\n    }\n    ```\n\n    **Config options**:\n\n      * `port`: required\n\n        TCP Port to check for online-status\n\n      * `values`: optional; default = using IPs\n\n        1-to-1 mapping to ip-lists. Lists must be of the same length\n\n\n2. The script is executed\n\n    `python3 /var/local/lib/nftables_addons/failover.py`\n\n  * It will load the configuration\n  * Run port-checks for all configured variables - use first host that is online\n  * Map hosts to values if supplied\n  * If no host is online - will use first host/value\n  * The new addon-config is written to `/tmp/nftables_failover.nft`\n  * Its md5-hash is compared to the existing config to check if it changed\n\n  * **If it has changed**:\n    * **Config validation** is done:\n\n      * An include-file is written to `/tmp/nftables_main.nft`:\n\n        ```nft\n        include /tmp/nftables_failover.nft\n        # including all other adoon configs\n        include /etc/nftables.d/addons/other_addon1.nft\n        include /etc/nftables.d/addons/other_addon2.nft\n        # include other main configs\n        include /etc/nftables.d/*.nft\n        ```\n\n      * This include-file is validated:\n\n        `sudo nft -cf /tmp/nftables_main.nft`\n\n    * The new config is written to `/etc/nftables.d/addons/failover.nft`\n    * The actual config is validated: `sudo nft -cf /etc/nftables.conf`\n    * NFTables is reloaded: `sudo systemctl reload nftables.service`\n\n\n3. You will have to include the addon-config in your main-config file `/etc/nftables.conf`:\n\n    ```\n    ...\n    include /etc/nftables.d/addons/*.nft\n    ...\n    ```\n\n----\n\n## Privileges\n\nIf the script should be run as non-root user - you will need to add a sudoers.d file to add the needed privileges:\n\n```text\nCmnd_Alias NFTABLES_ADDON = \\\n  /usr/bin/systemctl reload nftables.service,\n  /usr/sbin/nft -cf *\n\nservice_user ALL=(ALL) NOPASSWD: NFTABLES_ADDON\n```\n\nYou may not change the owner of the addon-files as the script will not be able to overwrite them.\n\n----\n\n## Safety\n\nAs explained above - there is a config-validation process to ensure the addon will not supply a bad config and lead to a failed nftables reload/restart.\n\nIf you want to be even safer - you can add a config-validation inside the `nftables.service`:\n\n```text\n# /etc/systemd/system/nftables.service.d/override.conf\n[Service]\n# catch errors at start\nExecStartPre=/usr/sbin/nft -cf /etc/nftables.conf\n\n# catch errors at reload\nExecReload=\nExecReload=/usr/sbin/nft -cf /etc/nftables.conf\nExecReload=/usr/sbin/nft -f /etc/nftables.conf\n\n# catch errors at restart\nExecStop=\nExecStop=/usr/sbin/nft -cf /etc/nftables.conf\nExecStop=/usr/sbin/nft flush ruleset\n\nRestart=on-failure\nRestartSec=5s\n```\n\nThis will catch and log config-errors before doing a reload/restart.\n\n----\n\n## Scheduling\n\nYou can either:\n\n* Add a Systemd Timer: [example](https://github.com/ansibleguy/addons_nftables/tree/latest/templates/etc/systemd/system)\n* Add a cron job\n\n----\n\n## Ansible\n\nHere you can find an Ansible Role to manage NFTables Addons:\n\n* [ansibleguy.addons_nftables](https://github.com/ansibleguy/addons_nftables)\n* [examples](https://github.com/ansibleguy/addons_nftables/blob/latest/Example.md)\n\n----\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fo-x-l%2Fnftables_addon_failover","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fo-x-l%2Fnftables_addon_failover","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fo-x-l%2Fnftables_addon_failover/lists"}