FRRutingとdebian13 LXCで冗長化ルータ NAPTとconntrackd

Ipv4フォワーディング有効済み
WAN側 NAPT

sudo apt update
sudo apt install keepalived conntrackd

sudo bash -c 'cat <<EOF > /etc/sysctl.d/99-conntrack.conf
net.netfilter.nf_conntrack_acct = 1
net.netfilter.nf_conntrack_checksum = 1
EOF
sysctl --system'

# nano /etc/conntrackd/conntrackd.conf
Sync {
    Mode FTFW {
        CommitTimeout 180
        PurgeTimeout 60
        ResendQueueSize 131072
        ACKWindowSize 300
        DisableExternalCache Off
    }
    Multicast {
        IPv4_address 225.0.0.50
        Group 3780
        IPv4_interface 192.168.0.1 # 同期用I/FのIP
        Interface eth3
        SndSocketBuffer 1249280
        RcvSocketBuffer 1249280
        Checksum on
    }
}
General {
    HashSize 8192
    HashLimit 65535
    Syslog on
    LockFile /var/lock/conntrackd.lock
    UNIX {
        Path /var/run/conntrackd.sock
        Backlog 20
    }
    SocketBufferSize 262142
    SocketBufferSizeMaxGrown 655355
    Systemd on
}

有効化

sudo systemctl enable --now conntrackd

構文チェック

sudo conntrackd -C /etc/conntrackd/conntrackd.conf -t

#再起動
sudo systemctl restart conntrackd

ステータス確認

sudo conntrackd -s

[Tue Oct 13 12:13:41 2026] (pid=396) [warning] deprecated unix backlog configuration, ignoring.
cache internal:
current active connections:                2
connections created:                       2    failed:            0
connections updated:                       0    failed:            0
connections destroyed:                     0    failed:            0

cache external:
current active connections:               31
connections created:                      66    failed:            0
connections updated:                     114    failed:            0
connections destroyed:                    35    failed:            0

traffic processed:
                   0 Bytes                         0 Pckts

multicast traffic (active device=eth3):
                2176 Bytes sent                14012 Bytes recv
                 133 Pckts sent                  342 Pckts recv
                   0 Error send                    0 Error recv

message tracking:
                   0 Malformed msgs                    0 Lost msgsきたな

もしうまくいかないとき
FWの設定をみてみる
nftablesの場合

nano /etc/nftables.conf
#---追加
chain input {
ip daddr 225.0.0.50 udp dport 3780 accept
ip protocol vrrp accept
}
#---
sudo nft -f /etc/nftables.conf

sudo nano /usr/local/bin/conntrackd-notify.sh
#---
#!/bin/bash
# Keepalived conntrackd Notification Script
TYPE=$1
NAME=$2
STATE=$3
case $STATE in
    "MASTER")
        /usr/sbin/conntrackd -c
        /usr/sbin/conntrackd -f

        /usr/sbin/conntrackd -B
        ;;
    "BACKUP")
        /usr/sbin/conntrackd -f
        ;;
    "FAULT")
        /usr/sbin/conntrackd -f
        ;;
    *)
        echo "Unknown state: $STATE" >&2
        exit 1
        ;;
esac
exit 0
#---
sudo chmod +x /usr/local/bin/conntrackd-notify.sh

nano /etc/keepalived/keepalived.conf
#---
vrrp_instance VI_1 {
    state MASTER            # もう1台は BACKUP
    interface eth3          # VRRP通信用インターフェース
    virtual_router_id 51
    priority 101            # BACKUP側は 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass secret123
    }
    virtual_ipaddress {
        192.168.254.30/27 dev eth1
    }
    # conntrackd 連携スクリプトの呼び出し設定
    notify /usr/local/bin/conntrackd-notify.sh
}

#---
sudo systemctl restart keepalived

片方のルータを電源落としたときにVIPが入れ替わればOK

複数のI/FでVIPを設定したいとき

#...既存のVI_1 {
#略
}
# 2つ目のインスタンスを追加
vrrp_instance VI_2 {
    state MASTER
    interface eth3 # VRRPの死活監視・制御用パケットを流すIF 共通でOK
    virtual_router_id 52 # VI_1 とは別のIDにする
    priority 101 
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass secret123
    }
    virtual_ipaddress {
        10.0.0.30/24 dev eth2
    }
}

priorityはマスターになる優先度、値が大きい方が優先される。