0

I have two internet connections, from two different ISPs and I need failover host for my local network between the two ISPs. I am using CentOS6.

eth0 – ISP 1
eth1 – ISP 2
eth2 – local network interface

Configs:
eth0

DEVICE=eth0
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=none
HWADDR=00:15:5D:AA:AD:A6
IPADDR=12.12.12.226
DNS1=202.119.32.5
DNS2=202.119.32.9
NAME="System eth0"
NETMASK=255.255.255.248
USERCTL=no

eth1

DEVICE=eth1
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=none
HWADDR=00:15:5D:AA:AD:A7
IPADDR=11.11.11.115
DNS1=198.169.104.130
NAME="System eth1"
NETMASK=255.255.255.240
USERCTL=no

eth2

DEVICE=eth2
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=none
HWADDR=00:15:5D:AA:AD:A8
IPADDR=192.168.110.181
NAME="System eth2"
NETMASK=255.255.255.0
USERCTL=no

route-eth0

12.12.12.224/29 dev eth0 table vega
###
12.12.12.224/29 dev eth0 src 12.12.12.226
###
12.12.12.224/29 dev eth0 src 12.12.12.226 table kyivstar
default via 12.12.12.225 table kyivstar

route-eth1. scope of two ISP in it interface route.

11.11.11.112/28 dev eth1 table kyivstar
###
11.11.11.112/28 dev eth1 src 11.11.11.115
###
11.11.11.112/28 dev eth1 src 11.11.11.115 table vega
default via 11.11.11.113 table vega
#need, because after network servicerestart, default scope are fallen
default scope global nexthop via 12.12.12.225 dev eth0 weight 4 nexthop via 11.11.11.113 dev eth1 weight 1

route-eth2 (local network):

192.168.110.0/24 dev eth2 table kyivstar
192.168.110.0/24 dev eth2 table vega

rule-eth0:

from 12.12.12.226 lookup kyivstar

rule-eth1:

from 11.11.11.115 lookup vega

My rt_tables:

#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1      inr.ruhep

1       kyivstar
2       vega

Next, my iptables script:

#!/bin/bash

IPTABLES="/sbin/iptables"

$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X

/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe ip_gre
/sbin/modprobe ip_nat_pptp

$IPTABLES -A FORWARD -i eth2 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Finally my failover script:

#!/bin/bash

# Conventionally 0 indicates success in this script.

# Time between checks in seconds
SLEEPTIME=10

#IP Address or domain name to ping. The script relies on the domain being
#pingable and always available
TESTIP=8.8.8.8

#Ping timeout in seconds
TIMEOUT=2

# External interfaces
EXTIF1=eth0
EXTIF2=eth1

#IP address of external interfaces. This is not the gateway address.
IP1=`ifconfig $EXTIF1 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'`
IP2=`ifconfig $EXTIF2 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'`

#Gateway IP addresses. This is the first (hop) gateway, could be your router IP
#address if it has been configured as the gateway
GW1=`sipcalc $EXTIF1 | grep -w 'Usable range' | awk '{ print $4 }'`
GW2=`sipcalc $EXTIF2 | grep -w 'Usable range' | awk '{ print $4 }'`

# Relative weights of routes. Keep this to a low integer value. I am using 4
# for TATA connection because it is 4 times faster
W1=4
W2=1

# Broadband providers name; use your own names here.
NAME1=kyivstar
NAME2=vega

#No of repeats of success or failure before changing status of connection
SUCCESSREPEATCOUNT=4
FAILUREREPEATCOUNT=1

# Do not change anything below this line

# Last link status indicates the macro status of the link we determined. This is down initially to force routing change upfront. Don't change these values.
LLS1=1
LLS2=1

# Last ping status. Don't change these values.
LPS1=1
LPS2=1

# Current ping status. Don't change these values.
CPS1=1
CPS2=1

# Change link status indicates that the link needs to be changed. Don't change these values.

CLS1=1
CLS2=1

# Count of repeated up status or down status. Don't change these values.
COUNT1=0
COUNT2=0

# Log file
CHECKGATEWAYLOG=/termolife/gwping_status

while : ; do
        ping -W $TIMEOUT -I $IP1 -c 1 $TESTIP > /dev/null  2>&1
        RETVAL=$?

        if [ $RETVAL -ne 0 ]; then
                echo $(date) "______" $NAME1 Down >> $CHECKGATEWAYLOG
                CPS1=1
        else
                CPS1=0
        fi

        if [ $LPS1 -ne $CPS1 ]; then
                echo $(date) "______" Ping status changed for $NAME1 from $LPS1 to $CPS1 >> $CHECKGATEWAYLOG
                COUNT1=1
        else
                if [ $LPS1 -ne $LLS1 ]; then
                        COUNT1=`expr $COUNT1 + 1`
                fi
        fi

        if [[ $COUNT1 -ge $SUCCESSREPEATCOUNT || ($LLS1 -eq 0 && $COUNT1 -ge $FAILUREREPEATCOUNT) ]]; then
                echo $(date) "______" Uptime status will be changed for $NAME1 from $LLS1 >> $CHECKGATEWAYLOG
                CLS1=0
                COUNT1=0
                if [ $LLS1 -eq 1 ]; then
                        LLS1=0
                else
                        LLS1=1
                fi
        else
                CLS1=1
        fi

        LPS1=$CPS1

        ping -W $TIMEOUT -I $IP2 -c 1 $TESTIP > /dev/null  2>&1
        RETVAL=$?

        if [ $RETVAL -ne 0 ]; then
                echo $(date) "______" $NAME2 Down >> $CHECKGATEWAYLOG
                CPS2=1
        else
                CPS2=0
        fi

        if [ $LPS2 -ne $CPS2 ]; then
                echo $(date) "______" Ping status changed for $NAME2 from $LPS2 to $CPS2 >> $CHECKGATEWAYLOG
                COUNT2=1
        else
                if [ $LPS2 -ne $LLS2 ]; then
                        COUNT2=`expr $COUNT2 + 1`
                fi
        fi

        if [[ $COUNT2 -ge $SUCCESSREPEATCOUNT || ($LLS2 -eq 0 && $COUNT2 -ge $FAILUREREPEATCOUNT) ]]; then
                echo $(date) "______" Uptime status will be changed for $NAME2 from $LLS2 >> $CHECKGATEWAYLOG
                CLS2=0
                COUNT2=0
                if [ $LLS2 -eq 1 ]; then
                        LLS2=0
                else
                        LLS2=1
                fi
        else
                CLS2=1
        fi

        LPS2=$CPS2

        if [[ $CLS1 -eq 0 || $CLS2 -eq 0 ]]; then
                if [[ $LLS1 -eq 1 && $LLS2 -eq 0 ]]; then
                       ip route flush cache
                        echo $(date) "______" Switching to $NAME2 >> $CHECKGATEWAYLOG
                        ip route replace default scope global via $GW2 dev $EXTIF2
                        ip route show | awk '{print}' | grep 'eth0\|eth1' >> $CHECKGATEWAYLOG
                elif [[ $LLS1 -eq 0 && $LLS2 -eq 1 ]]; then
                       ip route flush cache
                        echo $(date) "______" Switching to $NAME1 >> $CHECKGATEWAYLOG
                        ip route replace default scope global via $GW1 dev $EXTIF1
                        ip route show | awk '{print}' | grep 'eth0\|eth1' >> $CHECKGATEWAYLOG
                elif [[ $LLS1 -eq 0 && $LLS2 -eq 0 ]]; then
                       ip route flush cache
                        echo $(date) "______" Restoring default load balancing >> $CHECKGATEWAYLOG
                        ip route replace default scope global nexthop via $GW1 dev $EXTIF1 weight $W1 nexthop via $GW2 dev $EXTIF2 weight $W2
                        ip route show | awk '{print}' | grep 'eth0\|eth1' >> $CHECKGATEWAYLOG
                fi
        fi
        sleep $SLEEPTIME
done

All ok, when ISP kyivstar fallen – my default route is changed on ISP vega. But, on client (windows 7), when i check ping (ping gmail.com -t) and turn off ISP kyivstart, i see that packets lost. But, when i check ping on other host (ping facebook.com), i see – all packets are delivered.
When i check "tracert" on windows client, i see that packets go on gateway ISP kyivstar, but not on ISP vega. In table of routing on host(server), i see, that default gateway was changed on ISP vega. And if, i check ping on host (server) – all packets go to gateway ISP vega.

In google, i see, that problem in cache of routing. Ok.

I put in sysctl.conf:

sysctl -w net.ipv4.route.secret_interval=0   

But, it can't help me. How to solve this problem ? Thanks for your attention.

  • Can you try netsh interface ip delete destinationcache from an administrative console on your windows client after you switched the ISP on the server? I don't think this is a server error. – Broco Sep 2 '16 at 10:36
  • Sorry Broco. It can't help me. Ping fallen. Tracert go by old route. – Piduna Valeriu Sep 3 '16 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.