Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm banging my head against the wall to come up with a clever and simple solution to WAN failover. This is for a SOHO installation with two different external IPs. Only outbound connection failover needed.

  • Provider 1: Cable
  • Provider 2: Wireless

The Firewall is a Debian GNU/Linux, so the solution should use Linux and be software-based.

Current Network Situation

I want to be able to not only detect, if one of the routers go down (thats easy with iproute2), but when their connections go down. Both routers dont have SNMP or some other standards based RMON.

Is there something like a ping utility where I can specify the default route to use?

That way I could monitor both links optimally with a small script. Or should I go some other route?

share|improve this question
up vote 3 down vote accepted

This is a little more complex since I'm assuming that your routers can't export their routes in a meaningful way. If you feel like digging into it, remember that when you send a packet locally the IP address is still the far-end host and the MAC address (on Ethernet, anyway) is based on the hosts route table and arp cache.

If you knock your software down a level and use the kernel's packet calls to form your message, you can write that IP packet with the MAC address of your choice. The packet will then use the router of your choice as the first hop. Use that to ping and monitor responses and you'll be able to test connectivity without changing system settings.

Of course, you'll need some elevated permissions in your program to accomplish this.

Otherwise, forced single-address routing table entries suggested by Evan will allow you to stay out of writing things that call on the kernel. For any method where the router's aren't complicit in telling you, you need to be in the DMZ otherwise you can't choose where your packets go unless you somehow end up with source routing enabled.

share|improve this answer

Host routes to "canary" IP addresses are what you're looking for.

Choose an IP address on the far side of each router to be used as the "canary" to monitor with PING (or HTTP GET, or whatever failure metric you want to use). Add a static route with a /32 netmask on the firewall for that "canary" IP address to send it out the appropriate router.

If I were monitoring "" via the "" router I'd add the route with route add gw After adding that route all traffic to would be routed via the gateway at If the Internet connection on the far side of fails traffic to won't ever arrive at its destination (no PINGs will return, etc).

Using host routes like this should enable you to write a simple script to swap the default gateway in the event of failure of one of the Internet connections.

share|improve this answer
Waaah! This answer just rocks. Exactly what I was looking for. Shame on me for not coming up with it myself when rereading man route. Thanks! – Peter Meyer Mar 15 '12 at 10:30

If you want to use as 'canary' some high availability cluster (like or that uses round-robin DNS and multiple IPs (maybe from a couple of ranges), that host routes are not very helpful.

On Linux host you usual 'ping' utility has two helpfull arguments:

ping -I <interface> Ping will sent packets from specified interface. Use it if your host has separate interface for each connection.

ping -m <interface> Ping will send 'marked' outgoing packets; kernel could use these marks to select outgoing route. Useful if you accessing both you uplink channels through single interface. This requires mark-based ip routing rules, which you probably will use on multi-wan host in any case (to send answers for requests from internet by the same link, not by default route). Here is very short description how to do such routing.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.