keepalived Floating IP Failover (VRRP Setup)

A floating (virtual) IP that moves between two servers removes a single point of failure for load balancers, proxies or databases. keepalived implements VRRP: the servers elect a master that holds the IP, and a backup takes over within seconds if the master or its service fails.

Before you start

Two Linux servers or VMs on the same Layer 2 network (same VLAN/bridge), e.g. two VMs on your own KVM hosts.
A spare IP in that subnet routed to both machines.
On many cloud and VPS platforms, VRRP multicast or IP moves are blocked; you must use the provider's floating/failover IP API instead (keepalived can call a script for that).
Background: high availability basics.

Install keepalived

sudo apt install -y keepalived

AlmaLinux/Rocky: sudo dnf install -y keepalived.

Configure the master

/etc/keepalived/keepalived.conf on server A:

vrrp_script chk_nginx {
    script "/usr/bin/systemctl is-active --quiet nginx"
    interval 2
    fall 2
    rise 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 150
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass s3cretPW
    }
    virtual_ipaddress {
        203.0.113.100/24
    }
    track_script {
        chk_nginx
    }
}

Configure the backup

On server B use the same file with state BACKUP and a lower priority such as 100. virtual_router_id and the password must match on both and be unique on the network.

Start and check

sudo systemctl enable --now keepalived

ip -4 addr show eth0

The master shows the extra address 203.0.113.100. Allow VRRP (IP protocol 112) between the servers in your firewall.

Test failover

Run a continuous ping or curl loop against the floating IP from another machine.
Stop Nginx on the master: sudo systemctl stop nginx.
Within a few seconds the backup takes the IP; traffic continues. Start Nginx again and the master reclaims it (disable with nopreempt if you prefer it to stay).

Combine with HAProxy

The classic pattern is two HAProxy or Nginx load balancers with keepalived in front of several backend servers. See HAProxy load balancer setup.

Troubleshooting

Both servers hold the IP (split brain): VRRP packets are blocked; allow protocol 112 or use unicast peers (unicast_peer).
IP moves but traffic does not follow: switches or the provider cache the old MAC; keepalived sends gratuitous ARP, but provider networks may need API-based failover.
Check script never fails: test it manually and check journalctl -u keepalived.

Frequently asked questions

Does keepalived replicate data?

No, only the IP. Databases need their own replication.

Unicast or multicast?

Multicast is default; unicast works on networks that block multicast.

Can I use it on two VPSs at different providers?

Not for a shared IP. Use DNS failover or a global load balancer instead.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket