title: AWS site-to-site VPN high availability
body: <p>I have two FreeBSD servers working as firewalls configured with carp IP address which can float between the two servers to achieve high availability.</p>
  
  <p>Now I have setup ipsec tunnels to my VPC on AWS with <code>racoon</code> and <code>ipsec-tools</code>.
  I had to configure the two 169.254.x.x IP addresses on my public network interface to make the tunnel work.</p>
  
  <p>The problem with this is that if my firewall failover, I will have to add the two 169.254.x.x ip addresses on the other firewall.</p>
  
  <p>I tried adding 169.254.x.x ip addresses on the loopback interface, but it didn't work.</p>
  
  <p>My current solution is add one of the ip addresses(169.254.33.120) on my first server and the other ip address(169.254.35.140) on the second server.
  But with this solution, I lose redundancy because only one tunnel is up.</p>
  
  <p>Has anyone got a better solution?</p>