LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-27-2009, 05:46 PM   #1
mangueJOE
Member
 
Registered: Nov 2001
Location: Brazil
Distribution: Ubuntu, Debian
Posts: 66

Rep: Reputation: 16
Simple way to use backup gateway (metric?)


This firewall has 3 interfaces (name fw1)
eth0 is WAN IP 200.200.200.2
eth1 is LAN IP 192.168.0.1
eth2 is DMZ IP 192.168.100.1

DMZ has another gateway (fw2) with a WAN interface. It also has DMZ interface with IP 192.168.100.5 (which is the second default gateway for fw1)


fw1 routing table
Code:
root@fw:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
200.200.200.0   0.0.0.0         255.255.255.192 U     0      0        0 eth0
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 eth2
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
0.0.0.0         200.200.200.1   0.0.0.0         UG    100    0        0 eth0
0.0.0.0         192.168.100.5   0.0.0.0         UG    200    0        0 eth2
As you can see it has 2 default gateways. If the eth0 default gw link fails, the second default gw doesn't work.

The only way the second link work is to actually disable eth0 (ifconfig eth0 down).

If both interfaces are up, but eth0 internet link (not the interface) gets down, the firewall wont use the second gateway. I checked man page for route and it says metric isn't used for recent kernels.

Is there a way to make it work?
 
Old 08-28-2009, 11:24 AM   #2
evilted
Member
 
Registered: Aug 2009
Location: Ouagadougou, Burkina Faso
Distribution: centos
Posts: 92

Rep: Reputation: 18
i use a script, its original author called it gwping. i use an adapted version of it for redundancy in load balancing multiple external links, but im sure you can adapt it to suit your needs.

it can be found here:

http://blog.taragana.com/wp-content/upload/gwping

i am sure there are other methods, and if anyone knows other methods I too am all ears!

Other methods that I have tried have not been so good, likewise the gwping method: qos can be a cause of packet loss, ping (icmp) is one of the lowest in qos, and would be the first dropped over something like a sip call, and can cause your routes to be switched when in fact nothing is wrong with the current link.

i would really like to take advantage of the kernel's ability to detect dead gateways, but my problem is that my isp is dodgy, and not the connection between my servers and modems/routers. the dead gateway detection should be able to tell when the next hop goes down (not the connection leaving the ISP which is where i have problems 2 to 4 hops away), and will then mark the route as being dead. when having multiple defaults the next in the order should therefore take over.


metrics are not a 'failover or redundancy measure':

"Set the routing metric of the interface to n, default 0. The routing metric is used by the routing protocol. Higher metrics have the effect of making a route less favorable; metrics are counted as addition hops to the destination network or host."

Last edited by evilted; 08-28-2009 at 11:30 AM.
 
Old 08-31-2009, 10:46 AM   #3
mangueJOE
Member
 
Registered: Nov 2001
Location: Brazil
Distribution: Ubuntu, Debian
Posts: 66

Original Poster
Rep: Reputation: 16
Well for that matter, we will use manual intervention (ifconfig eth0 down) so the other link would work.

Problem is, now I have to setup another firewall with similar structure, with real load balancing and fail over. I'll try some stuff and post here the results.
 
Old 08-31-2009, 05:02 PM   #4
mangueJOE
Member
 
Registered: Nov 2001
Location: Brazil
Distribution: Ubuntu, Debian
Posts: 66

Original Poster
Rep: Reputation: 16
Ok I just found this: http://packages.debian.org/lenny/ifenslave-2.6

And some HOW-TOs:

For Debian lenny
http://www.howtoforge.com/nic-bonding-on-debian-lenny

For Centos
http://www.howtoforge.com/network_card_bonding_centos

Will give a go with Virtual Machines in Virtualbox and post here the results.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Inscrutable Ubuntu as a *simple* gateway UserLane Linux - Networking 13 02-15-2009 01:54 PM
backup gateway bondoq Linux - Networking 6 04-25-2007 12:31 PM
How to setup a simple gateway with Debian Kanon Linux - Networking 2 12-24-2006 05:03 PM
Simple Gateway Question caps_phisto Linux - Networking 7 02-28-2005 06:51 AM
probably simple, gateway issue? jfranks214 Linux - Networking 3 05-11-2004 10:51 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:32 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration