I have two internet connections, from two different ISPs and I need failover host for my local network between the two ISPs. I am using CentOS6.
eth0 – ISP 1
eth1 – ISP 2
eth2 – local network interface
Configs:
eth0
DEVICE=eth0
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=none
HWADDR=00:15:5D:AA:AD:A6
IPADDR=12.12.12.226
DNS1=202.119.32.5
DNS2=202.119.32.9
NAME="System eth0"
NETMASK=255.255.255.248
USERCTL=no
eth1
DEVICE=eth1
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=none
HWADDR=00:15:5D:AA:AD:A7
IPADDR=11.11.11.115
DNS1=198.169.104.130
NAME="System eth1"
NETMASK=255.255.255.240
USERCTL=no
eth2
DEVICE=eth2
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=none
HWADDR=00:15:5D:AA:AD:A8
IPADDR=192.168.110.181
NAME="System eth2"
NETMASK=255.255.255.0
USERCTL=no
route-eth0
12.12.12.224/29 dev eth0 table vega
###
12.12.12.224/29 dev eth0 src 12.12.12.226
###
12.12.12.224/29 dev eth0 src 12.12.12.226 table kyivstar
default via 12.12.12.225 table kyivstar
route-eth1. scope of two ISP in it interface route.
11.11.11.112/28 dev eth1 table kyivstar
###
11.11.11.112/28 dev eth1 src 11.11.11.115
###
11.11.11.112/28 dev eth1 src 11.11.11.115 table vega
default via 11.11.11.113 table vega
#need, because after network servicerestart, default scope are fallen
default scope global nexthop via 12.12.12.225 dev eth0 weight 4 nexthop via 11.11.11.113 dev eth1 weight 1
route-eth2 (local network):
192.168.110.0/24 dev eth2 table kyivstar
192.168.110.0/24 dev eth2 table vega
rule-eth0:
from 12.12.12.226 lookup kyivstar
rule-eth1:
from 11.11.11.115 lookup vega
My rt_tables:
#
# reserved values
#
255 local
254 main
253 default
0 unspec
#
# local
#
#1 inr.ruhep
1 kyivstar
2 vega
Next, my iptables script:
#!/bin/bash
IPTABLES="/sbin/iptables"
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe ip_gre
/sbin/modprobe ip_nat_pptp
$IPTABLES -A FORWARD -i eth2 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE
Finally my failover script:
#!/bin/bash
# Conventionally 0 indicates success in this script.
# Time between checks in seconds
SLEEPTIME=10
#IP Address or domain name to ping. The script relies on the domain being
#pingable and always available
TESTIP=8.8.8.8
#Ping timeout in seconds
TIMEOUT=2
# External interfaces
EXTIF1=eth0
EXTIF2=eth1
#IP address of external interfaces. This is not the gateway address.
IP1=`ifconfig $EXTIF1 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'`
IP2=`ifconfig $EXTIF2 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'`
#Gateway IP addresses. This is the first (hop) gateway, could be your router IP
#address if it has been configured as the gateway
GW1=`sipcalc $EXTIF1 | grep -w 'Usable range' | awk '{ print $4 }'`
GW2=`sipcalc $EXTIF2 | grep -w 'Usable range' | awk '{ print $4 }'`
# Relative weights of routes. Keep this to a low integer value. I am using 4
# for TATA connection because it is 4 times faster
W1=4
W2=1
# Broadband providers name; use your own names here.
NAME1=kyivstar
NAME2=vega
#No of repeats of success or failure before changing status of connection
SUCCESSREPEATCOUNT=4
FAILUREREPEATCOUNT=1
# Do not change anything below this line
# Last link status indicates the macro status of the link we determined. This is down initially to force routing change upfront. Don't change these values.
LLS1=1
LLS2=1
# Last ping status. Don't change these values.
LPS1=1
LPS2=1
# Current ping status. Don't change these values.
CPS1=1
CPS2=1
# Change link status indicates that the link needs to be changed. Don't change these values.
CLS1=1
CLS2=1
# Count of repeated up status or down status. Don't change these values.
COUNT1=0
COUNT2=0
# Log file
CHECKGATEWAYLOG=/termolife/gwping_status
while : ; do
ping -W $TIMEOUT -I $IP1 -c 1 $TESTIP > /dev/null 2>&1
RETVAL=$?
if [ $RETVAL -ne 0 ]; then
echo $(date) "______" $NAME1 Down >> $CHECKGATEWAYLOG
CPS1=1
else
CPS1=0
fi
if [ $LPS1 -ne $CPS1 ]; then
echo $(date) "______" Ping status changed for $NAME1 from $LPS1 to $CPS1 >> $CHECKGATEWAYLOG
COUNT1=1
else
if [ $LPS1 -ne $LLS1 ]; then
COUNT1=`expr $COUNT1 + 1`
fi
fi
if [[ $COUNT1 -ge $SUCCESSREPEATCOUNT || ($LLS1 -eq 0 && $COUNT1 -ge $FAILUREREPEATCOUNT) ]]; then
echo $(date) "______" Uptime status will be changed for $NAME1 from $LLS1 >> $CHECKGATEWAYLOG
CLS1=0
COUNT1=0
if [ $LLS1 -eq 1 ]; then
LLS1=0
else
LLS1=1
fi
else
CLS1=1
fi
LPS1=$CPS1
ping -W $TIMEOUT -I $IP2 -c 1 $TESTIP > /dev/null 2>&1
RETVAL=$?
if [ $RETVAL -ne 0 ]; then
echo $(date) "______" $NAME2 Down >> $CHECKGATEWAYLOG
CPS2=1
else
CPS2=0
fi
if [ $LPS2 -ne $CPS2 ]; then
echo $(date) "______" Ping status changed for $NAME2 from $LPS2 to $CPS2 >> $CHECKGATEWAYLOG
COUNT2=1
else
if [ $LPS2 -ne $LLS2 ]; then
COUNT2=`expr $COUNT2 + 1`
fi
fi
if [[ $COUNT2 -ge $SUCCESSREPEATCOUNT || ($LLS2 -eq 0 && $COUNT2 -ge $FAILUREREPEATCOUNT) ]]; then
echo $(date) "______" Uptime status will be changed for $NAME2 from $LLS2 >> $CHECKGATEWAYLOG
CLS2=0
COUNT2=0
if [ $LLS2 -eq 1 ]; then
LLS2=0
else
LLS2=1
fi
else
CLS2=1
fi
LPS2=$CPS2
if [[ $CLS1 -eq 0 || $CLS2 -eq 0 ]]; then
if [[ $LLS1 -eq 1 && $LLS2 -eq 0 ]]; then
ip route flush cache
echo $(date) "______" Switching to $NAME2 >> $CHECKGATEWAYLOG
ip route replace default scope global via $GW2 dev $EXTIF2
ip route show | awk '{print}' | grep 'eth0\|eth1' >> $CHECKGATEWAYLOG
elif [[ $LLS1 -eq 0 && $LLS2 -eq 1 ]]; then
ip route flush cache
echo $(date) "______" Switching to $NAME1 >> $CHECKGATEWAYLOG
ip route replace default scope global via $GW1 dev $EXTIF1
ip route show | awk '{print}' | grep 'eth0\|eth1' >> $CHECKGATEWAYLOG
elif [[ $LLS1 -eq 0 && $LLS2 -eq 0 ]]; then
ip route flush cache
echo $(date) "______" Restoring default load balancing >> $CHECKGATEWAYLOG
ip route replace default scope global nexthop via $GW1 dev $EXTIF1 weight $W1 nexthop via $GW2 dev $EXTIF2 weight $W2
ip route show | awk '{print}' | grep 'eth0\|eth1' >> $CHECKGATEWAYLOG
fi
fi
sleep $SLEEPTIME
done
All ok, when ISP kyivstar fallen – my default route is changed on ISP vega. But, on client (windows 7), when i check ping (ping gmail.com -t) and turn off ISP kyivstart, i see that packets lost. But, when i check ping on other host (ping facebook.com), i see – all packets are delivered.
When i check "tracert" on windows client, i see that packets go on gateway ISP kyivstar, but not on ISP vega. In table of routing on host(server), i see, that default gateway was changed on ISP vega. And if, i check ping on host (server) – all packets go to gateway ISP vega.
In google, i see, that problem in cache of routing. Ok.
I put in sysctl.conf:
sysctl -w net.ipv4.route.secret_interval=0
But, it can't help me. How to solve this problem ? Thanks for your attention.
