How to switch easily between net connections on a box w/ PCImodem AND LAN connection?

GrapefruiTgirl · 04-15-2007, 10:15 AM

System:
Intel P4 w/ LAN connection through WinXP machine AND a dialup Intel 536ep PCI modem.
Kernel 2.6.20, Slackware 11, LutelWall IPtables Firewall.

I currently am connected to the internet by LAN, through the WinXP machine, which contains a dialup modem. This is my default connection, because until today there were no drivers to get a modem working in my Linux machine.
So, my IP is static @ 192.168.0.2, gateway 192.168.0.1, smask 255.255.255.0, and I have the two DNS servers of my ISP listed in /etc/resolv.conf:

Code:

nameserver 142.123.456.78
nameserver 142.123.456.90
domain mshome.net

The LAN connection goes live during boot, and I don't have to think about anything, it's just connected and ready to go once my desktop is booted.

NOW, finally there is a modem driver for my kernel & modem. I want to be able to optionally use MY modem, in the case that the WinXP machine is down, broken, turned off, etc., and I would like to know what might be involved, if much of anything. I do NOT want to have to reconfigure all my internet files and settings every time before switching from LAN to dialup and back..
My /etc/networks file contains this:

Code:

loopback	127.0.0.0
localnet	192.168.0.1

I use LutelWall IPtables Firewall, which starts during boot. After this happens, a moment later the etc/rc.local file gets run, in which is the 'modprobe Intel536' command to insert the modem's kernel driver/module.
I'm fairly certain that if I were to dial out to the ISP and connect, the modem would work fine (on LAN as of this writing, so haven't tried yet) HOWEVER:

Question 1 - Will doing so change anything such that if I were to disconnect the modem and try using the LAN again, it wouldn't be configured correctly?

Question 2 - Is my firewall aware of, and able to filter, traffic on the dialup line? Or would I need to reconfigure and/or restart it after dialing out? And what about when I switch back to using the LAN? (In simple terms, can I have the firewall prepared to filter either connection automatically?)

Something tells me that when my ISP assigns me an IP address upon connection, it will effectively either screw up my LAN, or won't work at all because I have my IP address set as static BECAUSE of usually using the LAN. And on top of it all, I'm wondering if the firewall will by default only be looking at the LAN connection.

I haven't seen a very similar thread around here, and before posting, I hit the 'check for similar threads' button and nothing significant came up. I have a whack of networking tutorials here which I just recently downloaded, so am going through them as we speak, but if anyone can clarify/verify/mootify any of what I'm saying here, I'd appreciate it

GrapefruiTgirl · 04-15-2007, 04:27 PM

Yayy!! I think I'm almost there.. I am connected using the modem to write this post.
I added the following two rules to my firewall, to allow full two-way communication from me to the ISP and from the ISP to me (fake IP's inserted):

Code:

Rule	123.456.654.321	me	all			log,accept
Rule	me	123.456.654.321	all			log,accept

NOTE: This allows ALL/ALL in & out communication.. Is this necessary, or should/can I limit the protocol(s) to just a few protocols allowed? Or is this ok (as in SAFE)?

I added the following to /etc/rc.d/rc.inet1.conf:

Code:

IFNAME[1]="ppp0"
# next line, '1' was 'ppp0' so if failure, chg back
USE_DHCP[1]="yes"
IPADDR=[1]=""
NETMASK[1]=""
DHCP_IPADDR[1]=""
NETWORKING_IPV6[1]="no"
DHCP_HOSTNAME[1]="Sympatico"
DHCP_KEEPRESOLV[1]="yes"
DHCP_KEEPGW[1]="yes"

Is all this necessary, and/or appropriate?

.. and I toodled around with the KPPP settings for quite a while, because the modem was dialing and connecting, but then I couldn't communicate with it

so I am unsure yet if that was due to the firewall blocking that route, or something in KPPP settings.

Things to verify yet:
1 - I think the dialup connection needs to be dialed up, before I can get the firewall to filter it. Does this seem logical? So I need to reset/re-start the firewall AFTER connecting to the ISP, so the firewall becomes aware of the ISP's I.P. address and MY second I.P. address assigned to me from the ISP?
I think KPPP has a box/area for running scripts before/during/after connecting... If so, I'll add the firewall in there, and make it run after KPPP is connected.

Comments still welcome

UPDATE: Well, after disconnecting KPPP, the LAN wouldn't work right away. I ran 'ifconfig eth0 down' followed by 'ifconfig eth0 up' followed by './rc.inet1' followed by './rc.the-firewall' again, and that fixed it. Now, to narrow down which exactly of those I really need.. I'd guess **probably** if I had to pick just one, the './rc.inet1' should take care of it, but when switching from LAN to dialup, I suspect that that will have to be followed by running the firewall again, so the firewall again sees the new IP I have and latches onto it. Comments?

Finally, it proposes to be tricky running the firewall or rc.inet1 from KPPP, because both of those are owned by 'root,root' and I run KPPP as user.. More comments please?

GrapefruiTgirl · 04-17-2007, 10:54 AM

OK.. Let me rephrase the question, because currently, with a little bit of fiddling, I can manually switch over to dialup, and back. Sometimes more fiddling than others, but I can do it.
What I want.. Actually, I could probably find what I want and resolve this myself, if I knew what exactly what terminology, or 'function' I am looking for. Here's the situation:

1 - Machine boots up, discovers the onboard NIC (ETH0) with the LAN connected, and configures it automatically as the default (internet/network) connection.
1a - Machine also sets up (LO) loopback, though I don't know that this is relevant to the situation.
2 - IPtables-Firewall starts, configures itself, and exits.
3 - Now the machine is ready to use. To browse the internet, I'm using the LAN.

Problem:
1 - If I decide to shut down the LAN (or the lan is unavailable during boot) the machine ends up in a state of "no internet/network available until the LAN appears".
2 - So I dial up to the ISP using my modem, I connect and log in, using KPPP.
3 - Now, I have a ppp0 connection running, but can't yet use it.
4 - I fiddle with /etc/rc.inet1 by doing such things as stopping eth0, starting ppp0, restarting rc.inet1, restarting the firewall, etc... until I fluke into being able to actually use the ppp0 connection to browse the internet.

Solution needed:
Something that can help my machine tell if/when:
a) eth0 is up, and has connectivity; if so, use that.
b) oops, eth0 is NOT up, what else is around that I can connect thru?
c) Ahhh, I see a ppp0, and it seems to have connectivity. Let's use that.
d) Hmm, ok, ppp0 has gone away or been disconnected, what ever shall I do?
e) Oh look, there's eth0 again, does it connect yet? Yes

it does, let's use that now.

I would like a NAME for the ablility, or tool, or daemon, or whatever, is needed to make the above process of a,b,c,d,e automatic, so that I can connect either of my two methods of connecting, as I choose, and have the machine switch/default to firewalling and using the available connection, so I don't have to fiddle and frig with stuff to get it working.
I don't (yet) need to be told HOW to do what I need to do, but I would like to know the name(s) or terminology of what I want, so I can (Google) for information on the correct subject.
I've got piles of networking, IP routing, and other docs and tutorials here, and nowhere can I find this exact requirement. Everything seems to deal with either TWO machines sharing ONE connection, or setting up ROUTER machine, or external ROUTER, or how to divert traffic from connection 'A' through connection 'B', or connection load-balancing.... None of these is the right thing.
What am I looking for?

acid_kewpie · 04-17-2007, 11:14 AM

if your box were a cisco firewall, i'd just say use an ip sla, but it's not so i can't. there's a lot of little bits that would fit together well, but the easiest implementations i can see would always use ppp0 if it's available but lan if not, which still might be usable. after looking at lartc.org and linux-ha.org and diald.sf.net, there's a discussion here for just about the same thing which may save some repeated discussions http://lists.slug.org.au/archives/sl.../msg00118.html

at the most basic level you can simply add two gateways to your machine, but use a different metric on them, 10 for the lan, 20 for the dial interface, preferring the lower metrics. that's very very simple really, two things i'm not experienced with though is either the dynmaic adding of the ppp0 default route with a certian metric, probably quite quite possible. also though, if eth0 goes down then naturally the eth0 routes are down, but something like the remote router on the other side of a switch being down, eth0 itself is still there, just with no one to talk to, in which case you're looking at doing some more intelligent route monitoring. i mainly got stuck mentally knowing how to do that... i'm sure there's some daemon that can do it automatically, but you can easily just write a shell script to do it for you... just a short infinite loop that pings the lan gateway (or a remote remote host past it if you want to be even clever - think that would need iptables marking to force a certain route). if that ping fails for say, 5 consecutive attempts, then run a route command to whop out the lan route.

GrapefruiTgirl · 04-17-2007, 12:15 PM

Thanks so much for this, Chris.
I like the idea of the pinging routine to 'find life' on the other end of the interface.
And I especially like the term "Automatic IP Failover" which has sprung up a lot while pursuing stuff based on your post. I think that's what I'm looking for.
I'll update if/as I either get anywhere, or get totally stumped

acid_kewpie · 04-17-2007, 12:15 PM

well yes, only thing i can't put my finger on is a formal daemon for the task...

GrapefruiTgirl · 04-17-2007, 01:31 PM

I am looking at two related and maybe useful options:
1) UCARP, (http://www.ucarp.org/project/ucarp) which is BSD's implementation of automatic IP-failover.
2) NIC bonding via ifconfig -failover which I haven't read yet but here may be some info: http://209.85.165.104/search?q=cache...ient=firefox-a

UPDATE: I am getting the impression that the option -failover has been de-implemented.. Not sure yet, but here's a quote from here:http://docsun.cites.uiuc.edu/sun_doc...tml#MPOVERVIEW

Quote:

Originally Posted by Sun Microsystems IP Networking Multipath Admin guide

IP Network Multipathing Features

The Solaris implementation of IP network multipathing provides the following features:

* Failure Detection - Ability to detect when a network adapter has failed and automatic switching (failover) of the network access to an alternate network adapter. Failure detection can only occur when you have configured an alternate network adapter. See Detecting Physical Interface Failures for more information.
* Repair Detection - Ability to detect when a network adapter that failed previously has been repaired. The network access is switched back automatically (failback) to an alternate network adapter. Repair detection assumes that you have enabled failbacks. See Detecting Physical Interface Repairs for more information.
* Outbound Load Spreading - Outbound network packets are spread across multiple network adapters without affecting the ordering of packets in order to achieve higher throughput. Load spreading occurs only when the network traffic is flowing to multiple destinations that use multiple connections.

though the page is way out of date.

GrapefruiTgirl · 04-19-2007, 11:41 PM

Grr.. OK, repeated searches of all 'bonding' and related threads on LQ is getting nowhere. There's either no solution/follow-up to the threads, and/or they point to the same online tutorial pages over and over. The online pages always pertain to SuSE or RedHat, neither of which have the same file structure and network-configuration methods as Slackware.
@ AcidKewpie & others who have posted links elsewhere on 'bonding', thank you; I have pored over them, but to no avail.

Current problem: I don't know where to put (all of) the bonding config information, and I've played around enough so far that I have the all the devices 'in the system' but they aren't bonded together. The Master Device appears to be mostly OK, but the others are not getting made slaves, and the miimon is always showing to be 'down'.
Here's what I have right now as I write this post using my eth0 LAN connection:

Code:

# /etc/rc.d/rc.inet1.conf 
GATEWAY="192.168.0.1"
NETWORKING_IPV6="no"
DHCP_KEEPRESOLV="yes"
DHCP_KEEPGW="yes"
DEBUG_ETH_UP="yes"

IFNAME="bond0"
IPADDR="192.168.1.255"
BONDING_MASTER="yes"
BONDING_SLAVE0="eth0"
BONDING_SLAVE1="ppp0"
NETWORK="192.168.0.255"
NETMASK="255.255.255.0"

IFNAME[2]="eth0"
IPADDR[2]="192.168.0.2"
NETMASK[2]="255.255.255.0"
BROADCAST[2]="192.168.1.255"
NETWORK[2]="192.168.0.1"

IFNAME[1]="ppp0"
USE_DHCP[1]="yes"

Code:

#/etc/rc.my-iptables-firewall.config-file's interface locations: 
ExternalInterfaces	bond0 ppp0 eth0
InternalInterfaces  auto

Code:

 # ROUTE -n   and   IFCONFIG   outputs:

sh-3.2# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 bond0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         192.168.0.1     0.0.0.0         UG    1      0        0 eth0

sh-3.2# ifconfig
bond0     Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          inet addr:192.168.1.255  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST MASTER MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

eth0      Link encap:Ethernet  HWaddr 00:0C:76:0F:A5:ED
          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2329 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1877 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1412382 (1.3 MiB)  TX bytes:308299 (301.0 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:32 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:3088 (3.0 KiB)  TX bytes:3088 (3.0 KiB)

Code:

bash$# less /proc/net/bonding/bond0  
Ethernet Channel Bonding Driver: v3.1.1 (September 26, 2006)
Bonding Mode: fault-tolerance (active-backup)
Primary Slave: None
Currently Active Slave: None
MII Status: down
MII Polling Interval (ms): 1000
Up Delay (ms): 5000
Down Delay (ms): 0
/proc/net/bonding/bond0 lines 1-9/9 (END)

Code:

#/etc/modprobe.d/bonding
alias bond0 bonding
options bonding mode=active-backup miimon=1000 primary=eth0

Code:

#added to   /etc/rc.d/rc.local
...
# install bonding driver:
modprobe bonding
...

Code:

Files in /etc/sysconfig/network-scripts/  which I think don't do anything in Slackware, but the online tutorials say to use them:
# .../ifcfg-bond0
DEVICE=bond0
IPADDR=192.168.0.2
NETWORK=192.168.0.0
NETMASK=255.255.255.0
USERCTL=no
BOOTPROTO=none
ONBOOT=yes

# .../ifcfg-eth0
DEVICE=eth0
USERCTL=no
ONBOOT=yes
MASTER=bond0
SLAVE=yes
BOOTPROTO=none

# .../ifcfg-ppp0
DEVICE=ppp0
USERCTL=no
ONBOOT=yes
MASTER=bond0
SLAVE=yes
BOOTPROTO=none

I know some of this stuff is in the wrong place completely, but... this is where I'm at.
Suggestions appreciated, as always

Also, I realize that bonding may not work as intended when one of the NIC's is a ppp0, but some of the tutorials suggest it *can* work, so most importantly, I'd like to see the eth0 device bonded properly, and I'll worry about the ppp0 afterwards. Also, I'm aware that the IP/NETMASK/BROADCAST addresses are screwy, but I've been trying all sorts of combinations, and none of them work. My Knemo network monitor has never yet showed bond0 as being alive/active, despite the shell outputs above.
Thanks

acid_kewpie · 04-20-2007, 02:35 AM

i *really* don't think that you want bonding at all. not what you're after at all... essnetially with a pair of bondoed interfaces you can send any ip packet over any interface in the bond group and it'll end up at the same destination as if it all came from one interface. if you go to a website and load a webpage, with half the tcp packets on one adsl connection, half on dialup, it'll just choke completely...

GrapefruiTgirl · 04-20-2007, 08:22 AM

Chris, here's what I'm basing this work on: linux-ethernet-bonding-driver-howto located at:
http://www.cyberciti.biz/howto/quest...iver-howto.php

Which states:

Quote:

Originally Posted by the how-to above

mode
<...blah blah...>
active-backup or 1

Active-backup policy: Only one slave in the bond is
active. A different slave becomes active if, and only
if, the active slave fails. The bond's MAC address is
externally visible on only one port (network adapter)
to avoid confusing the switch.

In bonding version 2.6.2 or later, when a failover
occurs in active-backup mode, bonding will issue one
or more gratuitous ARPs on the newly active slave.
One gratutious ARP is issued for the bonding master
interface and each VLAN interfaces configured above
it, provided that the interface has at least one IP
address configured. Gratuitous ARPs issued for VLAN
interfaces are tagged with the appropriate VLAN id.

This mode provides fault tolerance. The primary
option, documented below, affects the behavior of this
mode.

This seems to be what I want--- If I have the ppp0 set as primary, and it goes down (I disconnect it) the connection will switch to eth0. If/when ppp0 comes back (I dial out again) the connection will switch back to it, because it is primary.
What do you think?

acid_kewpie · 04-20-2007, 08:35 AM

no, your issue is at layer 3 resilience, different ip's different subnets etc... whereas bonding is a layer 2 technology, i.e. you're still using the same ip addresses but over different hardware - same default gateway etc.

GrapefruiTgirl · 04-20-2007, 09:19 AM

Sorry Chris, but you've lost me there.. Layer 2? Layer 3? I haven't come across (definitions of) these terms so far.

acid_kewpie · 04-20-2007, 09:35 AM

well if you are interested, try this http://en.wikipedia.org/wiki/Osi_model but essentially it's really not what you are after.

nx5000 · 04-20-2007, 09:48 AM

I admit I haven't read the whole thread so excuse me if I'm completly out of topic

Maybe this would give you idea on how to do automatic detection:
http://guessnet.alioth.debian.org/
http://packages.debian.org/testing/a...aptop-net.html
http://0pointer.de/lennart/projects/ifplugd/

The links are for debian but there are probably same tools for any distro.

GrapefruiTgirl · 04-20-2007, 11:53 AM

@ Chris - I'll take your word (based on your experience) on that for the time being, about it being not what I'm looking for. There's likely a good chance you are correct, but until I can make sense of the logic behind this for myself, I'm going to keep digging

as I'm not the type to accept that I can't do it until I've "finished kicking the dead horse myself" so to speak..
Incidentally (and thank you) the Wiki about the OSI layers was somewhat informative in and of itself (it defined the layers just fine), but explained nothing to me, pro OR con, specfically about what I'm trying to do.
@ nx5000 - Thanks for those links; there is a tiny bit of potential there, but not much. And the 'Debian' factor is a little discouraging: If I could just find information about this entire ball of wax in a SLACKWARE context, I could probably figure out quickly the if/what/how/why of it all, but everything I come across is for RHEL/SLED/SLES and I can't seem to adapt what I read as easily as other things have been to adapt; networking is quite different, the file structure, directory structure..
Still looking