What it does
keepalived runs on two or more servers. With the VRRP protocol they elect a MASTER that holds the virtual IP (VIP); the others are BACKUP. If the master stops sending adverts (server down) or a track script fails (for example HAProxy died), a backup takes the VIP within seconds. Clients always use the VIP. It can also run IPVS load balancing.
Typical uses: two HAProxy nodes in front of web apps, or in front of the Kubernetes API (port 6443).
How to write it
keepalived [-f FILE] [-t] [-D] [-n]
systemctl {start|reload|status} keepalivedMain parts
Config parts
global_defs- Router ID, script security.
vrrp_scriptNAME{ script … interval … }- Health check.
vrrp_instanceNAME{ … }- One VIP group.
stateMASTER|BACKUP- Start role.
priorityN- Higher wins (100 master, 90 backup).
virtual_router_idN- Same on all nodes of one group (1–255).
virtual_ipaddress{ … }- The VIP(s).
authentication/unicast_peer- Simple auth / unicast instead of multicast.
track_script{ NAME }- Lower priority when the check fails.
Options 5
Most used
Flags
Nothing matches this filter.
Examples 10
$ run as a normal user# run as root (or with sudo)
1Install on both nodes
dnf install -y keepalived haproxy2Master node config
cat /etc/keepalived/keepalived.conf global_defs { router_id lb1 enable_script_security script_user root } vrrp_script chk_haproxy { script "/usr/bin/systemctl is-active --quiet haproxy" interval 2 fall 2 rise 2 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 51 priority 100 advert_int 1 unicast_src_ip 192.168.122.21 unicast_peer { 192.168.122.22 } virtual_ipaddress { 192.168.122.20/24 } track_script { chk_haproxy } }3Backup node: same file with these changes
grep -E "router_id|state|priority|unicast" /etc/keepalived/keepalived.conf router_id lb2 state BACKUP priority 90 unicast_src_ip 192.168.122.22 unicast_peer { 192.168.122.21 }4Allow VRRP in the firewall
firewall-cmd --permanent --add-rich-rule='rule protocol value="vrrp" accept' && firewall-cmd --reload5Check and start
keepalived -t -f /etc/keepalived/keepalived.conf systemctl enable --now keepalived6Who has the VIP?
ip -br addr show eth0 eth0 UP 192.168.122.21/24 192.168.122.20/247Test a failover
systemctl stop haproxy journalctl -u keepalived -n 5 ip -br addr show eth08Watch VRRP traffic
tcpdump -ni eth0 vrrp9Allow binding to the VIP on the backup (HAProxy)
10Read the state changes
journalctl -u keepalived | grep -E "MASTER|BACKUP|FAULT"
Nothing matches this filter.
Watch out
- Use a different
virtual_router_idper group on the same network, or groups fight. - In most clouds (Azure, AWS) VRRP/multicast and moving IPs do not work — use the cloud load balancer.
- Two masters at once (split brain) happen when nodes cannot see each other; check the firewall.
Files
/etc/keepalived/keepalived.conf- Configuration.
Tips to remember
- Use unicast peers in VMs and labs; multicast is often blocked.
Exit codes
0 | Success (config OK). |
1 | Error (config invalid). |