Connect a UPS to your Korthveil firewall and let it shut everything down in the right order when the power fails and the battery cannot last: first the machines that watch the UPS themselves (NUT clients), then the servers you choose (over SSH, in waves), and the firewall itself last. The UPS then switches its output off and on again when mains returns, so the firewall and your servers come back by themselves. The screenshots are from a test firewall with a simulated UPS; the example is a home rack with a NAS, a hypervisor and a few PCs.

The example:

When does the shutdown start? Only while the UPS is on battery, and as soon as one of these holds:

• it has been on battery for 60 seconds;
• the runtime left drops below 3 minutes;
• the battery drops below 30 %;
• the UPS itself reports low battery.

If mains returns before that, nothing is shut down: the outage is only logged. With less than 5 minutes of runtime, these defaults start the shutdown one minute after the power fails, or earlier when the runtime estimate drops below 3 minutes.

A failover pair (see Two firewalls with automatic failover): each firewall has its own UPS and its own settings. The standby shuts down after 30 seconds on battery to save its battery; the active firewall keeps your internet until its own triggers fire. When mains returns, the standby comes back and rejoins the pair.

Step 1: Prepare the firewall and the UPS

1. In the firewall's BIOS, set power on after power loss (often AC Power Recovery: On or Restore on AC Power Loss: Power On). Without it, the firewall stays off when the UPS restores power.
2. Plug the UPS into the firewall with its USB cable. A UPS already served by another NUT server also works; UPS units with a network card (SNMP) are supported in a later release.
3. Plug the firewall, the modem or ONT, and your switch into the UPS's battery-backed outlets, not the surge-only ones.

Step 2: Turn on UPS & power and choose the UPS

1. Open System › UPS & power and switch the add-in on.
2. Under UPS, press Scan. After a few seconds the UPS units the firewall finds are listed. Press Use this UPS on yours.
   • For a UPS on another NUT server, choose Another NUT server and type name@host, for example ups@192.168.2.5.
   • UPS units with a network card (SNMP) are supported in a later release.
3. Give it a Name (for example Rack UPS), press Save, then Review changes and Commit.

After the commit, Status shows the UPS: On line, the charge, the runtime left at the current load, the load, and the input and output voltage. The three graphs (charge, runtime, load) fill in as the firewall measures; you can add them to the dashboard with Layout › Add from other pages › UPS & power.

Step 3: Choose when to shut down

Under When to shut down, keep the defaults or change them:

• On battery for: 60 seconds. Set 0 to rely on the other triggers only.
• Runtime left below: 180 seconds.
• Battery below: 30 %.
• Failover standby: on battery for: 30 seconds (only on the standby of a pair).
• UPS cuts its output after: 120 seconds. Long enough for the firewall to finish shutting down.
• Power off the UPS at the end: on. The UPS turns its output off after that delay and on again when mains returns.

The line below the settings shows how long the whole shutdown can take. If it warns that the shutdown does not fit in the runtime, raise Runtime left, shorten On battery for, or lower the machines' budgets (Step 5).

Press Save and commit.

Step 4: Machines with a NUT client

Machines that can run a NUT client (upsmon) shut down by themselves when the firewall tells them to: Linux servers, Proxmox, XCP-ng, Synology and QNAP NAS units, and Windows with a NUT client. Nothing is stored on the firewall for them.

1. Under NUT clients, tick Let NUT clients watch this UPS.
2. Tick the network the machines are on (for example LAN). Korthveil opens TCP 3493 only there.
3. Keep the user monuser or type another, and enter a password for the clients. It is stored as a secret and never shown again.
4. Press Save and commit.

5. On each machine, point its NUT client at the firewall. On Linux, in upsmon.conf: MONITOR ups@192.168.2.4 1 monuser <password> secondary On Synology: Control Panel › Hardware & Power › UPS, Synology UPS server off, Network UPS server 192.168.2.4.

6. Back on the page, the machine is listed under Connected now.

NUT sends the password in the clear, so keep the clients on a trusted network.

One UPS for both firewalls of a failover pair

A UPS usually has one USB data port, so only one firewall can be connected to it by cable. The other firewall watches the same UPS over the network. In the example, the USB cable goes to korthmain (192.168.2.4) and the NUC watches korthmain's UPS.

On korthmain (the firewall with the USB cable):

1. Do Steps 2 and 3: choose the UPS found by Scan (USB), Save, and commit.
2. Under NUT clients, tick Let NUT clients watch this UPS, tick the LAN network, enter a user and a password for the clients, Save, and commit. This lets the other firewall (and your servers, Step 4) read the UPS.

On the NUC (no cable):

1. System › UPS & power › UPS › Connection: choose Another NUT server (ups@host).
2. Remote UPS (name@host): ups@192.168.2.4. Use korthmain's own address, not the shared gateway 192.168.2.1: after a failover the shared address is on the NUC itself, and it would then watch itself.
3. Save and commit. Status now shows the same charge, runtime and load as on korthmain.

What happens in an outage:

• The NUC is the standby, so after 30 seconds on battery it shuts itself down to save the battery (Standby shuts down after, Step 3). korthmain keeps the internet running.
• When korthmain's shutdown starts, it raises forced shutdown on its UPS. The NUC (if still on) and every NUT client see it and power off; korthmain powers off last.
• If korthmain is switched off while mains is on, the NUC can no longer read the UPS: Status shows that the UPS does not answer, and the NUC does not shut down because of that. If the UPS was already on battery, the NUC keeps counting the time on battery and still shuts down when its limit is reached.
• When mains returns, the UPS switches its output on and both firewalls start (with power on after power loss set in their BIOS). korthmain takes the active role back.

Each firewall keeps its own UPS & power settings: the configuration sync never copies them to the other.

Step 5: Machines shut down over SSH

For machines without a NUT client, the firewall logs in over SSH and runs their shutdown command.

Pick them from the network: under Machines to shut down, press Add from network. The firewall lists the machines its DHCP server knows (leases and reservations, with name, address and MAC). Tick the ones on this UPS and press Add.

Or add one by hand: press Add by hand and type the name and address (an IP address or a host name), and the MAC if you want Wake-on-LAN.

Then open each machine and fill in:

• How: SSH command, or NUT client for a machine from Step 4 (so the firewall waits for it).
• User, and a Private key (paste an OpenSSH key without a passphrase) or password. Both are secrets: they are never shown again, logged or exported.
• Command: sudo -n shutdown -h now by default. On Windows with OpenSSH: shutdown /s /t 0. On Linux, allow the user to run it without a password, for example in /etc/sudoers.d/korthveil: korthveil-shutdown ALL=(root) NOPASSWD: /usr/sbin/shutdown.
• Wave (group) and Budget: see below.
• Wake it with Wake-on-LAN when mains returns: needs the MAC.

Press Save and commit, then press Test connection on each SSH machine. The firewall logs in and runs nothing; the first login pins the machine's host key, and a later login with a different key is refused. If you reinstall a machine, press Forget host key and test again.

Waves, for many machines: give machines a wave and list the waves in order under Wave order, for example VMs, hosts, storage: virtual machines first, then the hypervisors, then the NAS that stores them. The machines of one wave shut down at the same time (up to 32 at once); the next wave starts when every machine of the wave has stopped answering, or its budget (120 seconds by default) has passed. The firewall goes last.

Wake-on-LAN: under Wake-on-LAN after mains is back for, enter for example 120 seconds. After a real shutdown, once mains has been back that long, the firewall wakes the machines you ticked.

Step 6: Test without powering off

Under Test shutdown (no power-off), press Test shutdown. Korthveil goes through the whole sequence and logs every step without carrying any out:

• forced shutdown for the NUT clients, and which ones are connected now;
• each wave, with what it would run on each machine and whether the machine answers now;
• whether the UPS can switch its output off and on again;
• the firewall's own power-off.

Fix whatever the log marks note (a machine that does not answer, a UPS that cannot restore its output), then test again. Do a real test with your UPS at a time you choose: unplug the UPS from the wall and watch the events.

What happens in a real outage

1. On battery: the event log shows The UPS is on battery, and Status shows the time since.
2. Mains returns early: Mains power is back; nothing else happens.
3. A trigger fires: Shutdown started, with the reason. Then, in order:
   1. forced shutdown for the NUT clients;
   2. the waves of SSH machines;
   3. the UPS is told to cut its output after the delay and restore it with mains;
   4. the firewall powers off.
4. Mains returns: the UPS switches its output on, the firewall starts (power on after power loss), and after the set time the machines with Wake-on-LAN are woken.

The step log of the last real shutdown stays on the page under Last real shutdown, and every event is in Events.

Good to know

• Budget: the whole shutdown takes up to the sum of each wave's longest budget plus about 30 seconds for the firewall. Keep it shorter than the runtime the UPS has left when the shutdown starts.
• Secrets: SSH keys and passwords, the NUT client password and an SNMP community are write-only. Backups and exports show them as set.
• Failover pair: each firewall keeps its own UPS & power settings; configuration sync does not copy them to the other. With one UPS for both, see One UPS for both firewalls of a failover pair.
• Simulated UPS: on a test firewall, choose Simulated UPS to try the policy with Simulate (on line, on battery, on battery and low). It powers the test firewall off like a real outage.