Run HAProxy on two Linux servers with the same configuration, then let Keepalived’s VRRP service move one virtual IP address between them. Clients always connect to that virtual IP; when the active load balancer or its HAProxy process fails, the standby claims the address and begins accepting traffic. This guide shows a Debian/Ubuntu or RHEL-family setup, explains the health-check and priority rules, and gives a failover test you can perform before production.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What HAProxy and Keepalived provide together
HAProxy distributes requests to backend application servers, but a single HAProxy host is still a single point of failure. Keepalived adds a second host and uses Virtual Router Redundancy Protocol (VRRP) to advertise one virtual IP address (VIP). At any moment, one node owns the VIP and receives client traffic. The other node runs HAProxy and waits in standby.
As an Amazon Associate I earn from qualifying purchases.
In the example below, lb1 is the preferred active node, lb2 is the standby, and 192.168.1.100 is a reserved address on their shared LAN. Both machines use the same HAProxy configuration and the same Keepalived instance settings except for the node name, state, and priority.
| Node | Keepalived state | Priority | Expected VIP state |
|---|---|---|---|
| lb1 | MASTER | 101 | Owns 192.168.1.100 during normal operation |
| lb2 | BACKUP | 100 | Does not own the VIP while lb1 is healthy |
The VIP must be unused before deployment and must be reachable on the same Layer 2 network as both load balancers. Reserve it in your network plan or DHCP system so another device cannot receive it.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites and network decisions
- Two Linux servers on the same subnet, with a stable hostname or address for each.
- Administrative access on both servers.
- A free VIP, such as
192.168.1.100/24, that is valid on the load-balancer interface. - Backend addresses and ports. This example uses
10.0.0.11:8080and10.0.0.12:8080. - A firewall policy that permits VRRP traffic (IP protocol 112) between the two nodes, plus client traffic to HAProxy and HAProxy traffic to the backends.
- The same HAProxy and Keepalived package family on both machines. Package versions are not pinned in this guide, so check the installed version’s syntax before applying it to production.
VRRP advertisements are the heartbeat that tells each node who owns the VIP. If the nodes cannot see one another’s advertisements, both may believe they are active and claim the address. That split-brain condition can produce intermittent connections and duplicate ARP ownership. A dedicated heartbeat network or configured unicast peers can reduce the risk where multicast VRRP is unavailable, but the exact unicast syntax depends on your Keepalived release.
Allow HAProxy to bind the floating address
Linux normally permits a process to bind only addresses currently assigned to a local interface. Because HAProxy must start on the standby before it owns the VIP, enable non-local binding on both nodes.
- Create a sysctl drop-in or edit the system sysctl configuration so it contains:
net.ipv4.ip_nonlocal_bind = 1- Apply the setting:
sysctl -pConfirm the value with sysctl net.ipv4.ip_nonlocal_bind. If your distribution loads a different sysctl file at boot, place the setting there and reload it before starting HAProxy.
Install HAProxy and Keepalived
Install both packages on lb1 and lb2. Use the command family for your distribution:
| Distribution family | Install command |
|---|---|
| Debian or Ubuntu | apt install haproxy keepalived |
| RHEL, Rocky Linux, or AlmaLinux | dnf install haproxy keepalived |
Do not enable Keepalived until both HAProxy configurations and the VIP details are correct. Starting VRRP with a wrong interface or an address already in use can cause an avoidable outage.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Build one identical HAProxy configuration
Edit /etc/haproxy/haproxy.cfg on both nodes. The important detail is that the frontend binds to the VIP, not to a node-specific address. With ip_nonlocal_bind enabled, HAProxy can start on lb2 even while lb1 owns the address.
frontend fe_web
bind 192.168.1.100:80
default_backend be_web
backend be_web
balance roundrobin
option httpchk GET /health
server web1 10.0.0.11:8080 check
server web2 10.0.0.12:8080 checkThis example listens for HTTP on port 80, distributes connections in round-robin order, and performs an HTTP check against /health on each backend. Replace the backend addresses, port, and health path with values that exist in your environment. The two HAProxy files should remain byte-for-byte identical unless you have a deliberate, documented reason to vary them.
Validate the file with the HAProxy binary supplied by your package before enabling the service. A typical check is:
haproxy -c -f /etc/haproxy/haproxy.cfgAfter a successful check, enable and start HAProxy on both nodes:
systemctl enable --now haproxyCheck systemctl status haproxy and the service journal. A bind error usually means the VIP is misspelled, the interface is not configured for non-local binding, or another process already uses port 80.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Configure Keepalived on the primary node
On lb1, create /etc/keepalived/keepalived.conf with the following template. Replace eth0 with the interface that carries the shared subnet, and replace the example authentication value with your own shared secret on both nodes.
global_defs {
router_id LB_PRIMARY
enable_script_security
}
vrrp_script chk_haproxy {
script "/usr/bin/systemctl is-active --quiet haproxy"
interval 2
fall 2
rise 2
weight -2
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 101
advert_int 1
authentication {
auth_type PASS
auth_pass vrrpKey9
}
virtual_ipaddress {
192.168.1.100/24 dev eth0
}
track_script {
chk_haproxy
}
}What each section does
router_ididentifies this Keepalived process in logs. It must be different on the two nodes.vrrp_scriptruns a local health check. Here it tests whether the HAProxy systemd service is active every two seconds.fall 2requires two consecutive failed checks before the script is considered failed;rise 2requires two successful checks before it is considered healthy again.weight -2subtracts two from the instance priority while the check is failing. With priorities 101 and 100, the primary falls below the standby and allows the standby to take over.virtual_router_id 51identifies the VRRP group. It must match on both nodes, and another VRRP group on the same network should use a different identifier.advert_int 1sends advertisements at one-second intervals.virtual_ipaddressdefines the address Keepalived adds and removes from the interface.track_scriptattaches the HAProxy check to this VRRP instance.
Current Keepalived man pages document a default script weight of zero, so specifying a negative weight explicitly avoids relying on a version-dependent default. Keepalived releases can differ in option validation and failure handling; review the man page installed with your package before changing priorities or weights.
Configure the standby node
Copy the configuration to lb2, then make the node-specific changes shown below. The virtual router ID, authentication settings, interface, VIP, advertisement interval, script, and tracking block must remain the same.
global_defs {
router_id LB_SECONDARY
enable_script_security
}
vrrp_script chk_haproxy {
script "/usr/bin/systemctl is-active --quiet haproxy"
interval 2
fall 2
rise 2
weight -2
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass vrrpKey9
}
virtual_ipaddress {
192.168.1.100/24 dev eth0
}
track_script {
chk_haproxy
}
}Do not give the standby a different VIP or authentication value. A mismatch prevents the two daemons from joining the same VRRP group. Keepalived’s state and priority determine preference at startup; the higher healthy priority, 101 in this example, wins the VIP.
Recommended Free Tools
Validate the configuration and start VRRP
Run a configuration test on each node before starting Keepalived:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
keepalived --config-test -f /etc/keepalived/keepalived.confThe --config-test option is reported by current packages, but option names can vary by release. If your binary rejects it, consult keepalived --help and the installed man page for the equivalent validation mode rather than starting an unverified file.
Once validation succeeds, enable the service on both nodes:
systemctl enable --now keepalivedInspect the service state and logs:
systemctl status keepalived
journalctl -u keepalived -n 100 --no-pagerAt this point, lb1 should own the VIP and lb2 should be in BACKUP state. Verify the address directly:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteip addr show eth0The output on the primary should include 192.168.1.100/24; the standby should not show that address while the primary is healthy.
Test failover before sending production traffic
Test both service failure and recovery while watching the Keepalived journal on both machines. A simple planned test is:
- Confirm the VIP is present on
lb1and absent fromlb2. - From a client, send requests to the VIP and confirm that HAProxy returns the expected backend response.
- On
lb1, stop HAProxy:
systemctl stop haproxy- Watch the logs:
journalctl -u keepalived -f- After the failed checks and VRRP advertisements are processed, run
ip addr show eth0on both nodes. The VIP should move tolb2within a few seconds under these two-second checks and one-second advertisements. - Send new client requests through the VIP and confirm that
lb2is accepting them. - Restart HAProxy on
lb1:
systemctl start haproxy- Confirm the service becomes healthy again. Because
lb1has the higher priority, decide whether your operational policy should allow it to reclaim the VIP automatically or leave the VIP on the recovered node until a controlled switchover. Do not add preemption-related options without checking the syntax and behavior of your installed Keepalived version.
A service-status check can miss a process that is running but hung or unable to serve requests. For a stronger signal, use a custom executable health-check script that performs a local HTTP request against HAProxy’s administrative or data endpoint, then returns a failure code when the response is unusable. Keep the script short, executable by the Keepalived process, and protected according to your distribution’s script-security requirements.
Understand timing, priority, and health-check behavior
The interval value controls how often Keepalived runs a vrrp_script; the documented default is one second, while this example uses two seconds. fall and rise add hysteresis so one transient failure does not immediately change ownership. With fall 2, two failed runs are required before the negative weight is applied. Actual client-visible interruption also depends on advertisement delivery, ARP or neighbor-cache updates, TCP connection state, and application retry behavior.
A negative script weight lowers the instance priority when the check fails. A positive weight raises it when the script succeeds. The current man-page default weight is zero; older third-party guides have documented different defaults, so set the value explicitly when failover depends on it. Keepalived also supports instance-level weighting, and some documentation reports that an instance-level value can override the script value. Keep all weighting in one clearly documented place and verify the effective behavior in a controlled test.
Prevent and diagnose split brain
Split brain occurs when both nodes become MASTER and add the same VIP. The usual trigger is a network partition or a firewall rule that blocks VRRP advertisements while leaving each server otherwise functional.
- Permit IP protocol 112 between the two load balancers in both directions.
- Check that the nodes use the intended interface and subnet.
- Look for simultaneous MASTER messages in
journalctl -u keepalived. - Use a dedicated heartbeat path or configured unicast peers when the network does not reliably carry VRRP multicast.
- Never “fix” duplicate ownership by manually adding the VIP on both servers; restore heartbeat communication and let one instance converge.
If clients report intermittent connections, first inspect ARP or neighbor tables and the switch path for duplicate ownership. Then verify that only one node reports the VIP in ip addr.
Troubleshooting checklist
The VIP never appears
- Check the interface name in
interfaceandvirtual_ipaddress. - Read Keepalived logs for authentication, permission, or syntax errors.
- Confirm that the VIP is not already assigned elsewhere.
- Verify that the VRRP instance is not held in FAULT by a failed tracking script.
HAProxy will not start on the standby
- Confirm
net.ipv4.ip_nonlocal_bindis 1 and reload the sysctl setting. - Run
haproxy -c -f /etc/haproxy/haproxy.cfg. - Check whether another local process already listens on port 80.
- Ensure both nodes use the same VIP spelling and address family.
The standby does not take over
- Confirm the firewall allows protocol 112.
- Check that
track_scriptreferences the exact script name. - Verify that the failed check applies the expected negative weight and that the resulting priority is below 100.
- Review
fall,rise, and advertisement timing in the logs.
Traffic reaches the VIP but backends are unavailable
- Test each backend address and port from the active HAProxy node.
- Request the configured
/healthpath directly and confirm the application returns the response your HAProxy health policy expects. - Check backend firewall rules and service listeners.
- Remember that existing TCP sessions can break during a VIP move; clients or applications need retry logic for a complete high-availability experience.
Operational practices after deployment
Keep the HAProxy files synchronized through configuration management rather than editing one node by hand. Apply changes to the standby first, validate them, then perform a controlled switchover and update the former primary. Record the VIP, interface, VRRP ID, priorities, authentication secret, and firewall rules in your runbook.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallMonitor more than the Keepalived process. Alert on VIP ownership changes, HAProxy service state, backend health, and repeated script failures. A node can be running while its network path, HAProxy listener, or every backend is unusable. Regularly repeat the stop-service test after package upgrades, kernel changes, interface renames, and firewall modifications.
Finally, treat the sample authentication value as configuration data, not a production secret. Use a private shared value on both nodes, restrict access to /etc/keepalived/keepalived.conf, and review file permissions after deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
