3

I'm banging my head against the wall to come up with a clever and simple solution to WAN failover. This is for a SOHO installation with two different external IPs. Only outbound connection failover needed.

  • Provider 1: Cable
  • Provider 2: Wireless

The Firewall is a Debian GNU/Linux, so the solution should use Linux and be software-based.

Current Network Situation

I want to be able to not only detect, if one of the routers go down (thats easy with iproute2), but when their connections go down. Both routers dont have SNMP or some other standards based RMON.

Is there something like a ping utility where I can specify the default route to use?

That way I could monitor both links optimally with a small script. Or should I go some other route?

3 Answers 3

3

This is a little more complex since I'm assuming that your routers can't export their routes in a meaningful way. If you feel like digging into it, remember that when you send a packet locally the IP address is still the far-end host and the MAC address (on Ethernet, anyway) is based on the hosts route table and arp cache.

If you knock your software down a level and use the kernel's packet calls to form your message, you can write that IP packet with the MAC address of your choice. The packet will then use the router of your choice as the first hop. Use that to ping and monitor responses and you'll be able to test connectivity without changing system settings.

Of course, you'll need some elevated permissions in your program to accomplish this.

Otherwise, forced single-address routing table entries suggested by Evan will allow you to stay out of writing things that call on the kernel. For any method where the router's aren't complicit in telling you, you need to be in the DMZ otherwise you can't choose where your packets go unless you somehow end up with source routing enabled.

5

Host routes to "canary" IP addresses are what you're looking for.

Choose an IP address on the far side of each router to be used as the "canary" to monitor with PING (or HTTP GET, or whatever failure metric you want to use). Add a static route with a /32 netmask on the firewall for that "canary" IP address to send it out the appropriate router.

If I were monitoring "10.0.0.1" via the "192.168.178.254" router I'd add the route with route add 10.0.0.1 gw 192.168.178.254. After adding that route all traffic to 10.0.0.1 would be routed via the gateway at 192.168.178.254. If the Internet connection on the far side of 192.168.178.254 fails traffic to 10.0.0.1 won't ever arrive at its destination (no PINGs will return, etc).

Using host routes like this should enable you to write a simple script to swap the default gateway in the event of failure of one of the Internet connections.

1
  • Waaah! This answer just rocks. Exactly what I was looking for. Shame on me for not coming up with it myself when rereading man route. Thanks! Mar 15, 2012 at 10:30
0

If you want to use as 'canary' some high availability cluster (like yahoo.com or google.com) that uses round-robin DNS and multiple IPs (maybe from a couple of ranges), that host routes are not very helpful.

On Linux host you usual 'ping' utility has two helpfull arguments:

ping -I <interface> example.com Ping will sent packets from specified interface. Use it if your host has separate interface for each connection.

ping -m <interface> example.com Ping will send 'marked' outgoing packets; kernel could use these marks to select outgoing route. Useful if you accessing both you uplink channels through single interface. This requires mark-based ip routing rules, which you probably will use on multi-wan host in any case (to send answers for requests from internet by the same link, not by default route). Here is very short description how to do such routing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .