I have setup a dual wan network on my Gentoo Linux server and would like to discuss this solution, which I have come up with, with the help of various websites. Unfortunately, I am not able to recall the various website that have come in handy as my research lies some time back. But, anyway thanks a lot all of you. In the end, someone, who is experienced with the gentoo wiki, can create an entry.
1. This is the exemplary network used (based on: http://lartc.org/howto/lartc.rpdb.multiple-links.html):
Code: Select all
________
+--------------+ /
192.168.0.0/24 | router0 | |
+-------------+IP: +-------
| | 192.168.0.254| /
eth2 IP: _ +------+-------+ +--------------+ |
192.168.2.1 \ | eth0 | |
\ |IP: | |
\ | 192.168.0.1 | |
__ \ |Default GW IP:| |
___/ \_ \ | 192.168.0.254| |
_/ \__ \ | | /
/ \ eth2| | |
| Local network -----+ server | | Internet
\_ __/ | | |
\__ __/ | | |
\___/ | eth1 | \
192.168.2.0/24 |IP: | |
| 192.168.1.1 | |
|Default GW IP:| |
| 192.168.1.254| |
+------+-------+ +--------------+ |
| | router1 | \
+-------------+IP: +-------
192.168.0.1/24 | 192.168.1.254| |
+--------------+ \________
2. First, "emerge -av sys-apps/iproute2" for routing. Then, add the following code to "/etc/iproute2/rt_tables" in order to create two new routing tables. One for each wan network at eth0 and eth1:
Code: Select all
100 first
101 second
Code: Select all
#!/bin/bash
#tools
IPTABLES="/sbin/iptables"
IP6TABLES="/sbin/ip6tables"
###interfaces
WAN0="eth0"; WAN0_IP="192.168.0.1"
WAN1="eth1"; WAN1_IP="192.168.1.1"
LAN="eth2"
###clearing iptables
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IP6TABLES -F
$IP6TABLES -t mangle -F
$IP6TABLES -X
$IP6TABLES -t mangle -X
$IP6TABLES -P INPUT DROP
$IP6TABLES -P OUTPUT ACCEPT
$IP6TABLES -P FORWARD DROP
###nat
$IPTABLES -t nat -A POSTROUTING -o $WAN0 -j SNAT --to-source $WAN0_IP
$IPTABLES -t nat -A POSTROUTING -o $WAN1 -j SNAT --to-source $WAN1_IP
###mangle (used for load balancing)
$IPTABLES -t mangle -A POSTROUTING -o $WAN0 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100
$IPTABLES -t mangle -A POSTROUTING -o $WAN1 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x101
$IPTABLES -t mangle -A PREROUTING -i $WAN0 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100
$IPTABLES -t mangle -A PREROUTING -i $WAN1 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x101
$IPTABLES -t mangle -A PREROUTING -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
$IPTABLES -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
###must have rules
$IPTABLES -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p icmp -j ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$IP6TABLES -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$IP6TABLES -A INPUT -p icmpv6 -j ACCEPT
$IP6TABLES -A INPUT -i lo -j ACCEPT
$IP6TABLES -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
###internet access
$IPTABLES -A FORWARD -i $LAN -o $WAN0 ! -d 192.168.0.0/16 -j ACCEPT
$IPTABLES -A FORWARD -i $LAN -o $WAN1 ! -d 192.168.0.0/16 -j ACCEPT
###default reject
$IPTABLES -A INPUT -j REJECT
$IPTABLES -A FORWARD -j REJECT
$IP6TABLES -A INPUT -j REJECT
$IP6TABLES -A FORWARD -j REJECT
Code: Select all
# chmod 700 /root/fw.sh
# /root/fw.sh
# /etc/init.d/iptables save
# /etc/init.d/ip6tables save
# rc-update add iptables boot
# rc-update add ip6tables boot
Code: Select all
# ip rule add fwmark 0x100 table 100
# ip rule add fwmark 0x101 table 101
Code: Select all
#!/bin/bash
ip rule add fwmark 0x100 table 100
ip rule add fwmark 0x101 table 101
5. We need to fill table 100 and 101 with routing rules. For this purpose, I created the file "/usr/local/bin/dualwan_routes.sh" with this code:
Code: Select all
#!/bin/bash
ip r flush table 0x100
ip r flush table 0x101
ip r | grep -v default | grep -v nexthop | while read I; do ip r add table 0x100 $I; ip r add table 0x101 $I; done
ip r add default via 192.168.0.254 dev eth0 table 0x100
ip r add default via 192.168.1.254 dev eth1 table 0x101
Code: Select all
*/1 * * * * /usr/bin/setlock -n /tmp/dualwan_routes.lock /usr/local/bin/dualwan_routes.sh > /dev/null 2>&1
For DD-WRT and OpenWrt, you have to create an ssh keypair without password as normal user on the Gentoo server by executing:
Code: Select all
~ ssh-keygen
- Go to "Administration" -> "Management" -> "Remote Access" and enable "SSH Management"
- Go to "Services" -> "Services" -> "Secure Shell", enable "SSHd" and add the following code to "Authorized Keys" (ssh-... is the ssh public key, e.g. id_rsa.pub, created in step 6.):
Code: Select all
command="nvram get wanup",no-port-forwarding,no-X11-forwarding,no-pty ssh-...
6.b) OpenWrt:
Go to "System" -> "Administration" -> "SSH Access" -> "SSH-Keys" and save this in the field (ssh-... is the ssh public key, e.g. id_rsa.pub, created in step 6.):
Code: Select all
command="ifstatus wan",no-port-forwarding,no-X11-forwarding,no-pty ssh-...
6.c) FritzBox:
Unfortunately, I only have the German version. Perhaps, someone can get the English names.
Go to "Heimnetz" -> "Netzwerk" -> "Programme" and enable "Statusinformationen über UPnP übertragen (empfohlen)".
English names might be:
"Home network" -> "network" -> "programs" and enable "status information over UPnP"
Save and apply.
7. You need to create the failover script "/usr/local/bin/dualwan_failover.sh" and adjust it to your needs (IP adresses, interface names and non-root username on the Gentoo server). I assume router0 being OpenWrt and router1 FritzBox:
Code: Select all
#!/bin/bash
#DD-WRT
#wan0=1
#if [ $(sudo -u david ssh root@192.168.0.254 2>/dev/null) -eq 1 ]; then
# wan0=0
#fi
#OpenWrt
wan0=1
if [ $(sudo -u david ssh root@192.168.0.254 2>/dev/null | grep -q '"up": true,'; echo $?) -eq 0 ]; then
wan0=0
fi
#FritzBox
sudo -u david curl -s "http://192.168.1.254:49000/upnp/control/WANIPConn1" \
-H "Content-Type: text/xml; charset="utf-8"" \
-H "SoapAction:urn:schemas-upnp-org:service:WANIPConnection:1#GetStatusInfo" \
-d "<?xml version='1.0' encoding='utf-8'?> \
<s:Envelope s:encodingStyle='http://schemas.xmlsoap.org/soap/encoding/' xmlns:s='http://schemas.xmlsoap.org/soap/envelope/'> \
<s:Body> <u:GetStatusInfo xmlns:u='urn:schemas-upnp-org:service:WANIPConnection:1' /> \
</s:Body> </s:Envelope>" |\
sudo -u david grep -q "<NewConnectionStatus>Connected</NewConnectionStatus>"
wan1=$?
ip r | sudo -u david grep -q ^default[[:space:]]\*$
both=$?
ip r | sudo -u david grep -q "default via 192.168.0.254 dev eth0"
first=$?
ip r | sudo -u david grep -q "default via 192.168.1.254 dev eth1"
second=$?
if [[ $wan0 -eq 0 ]] && [[ $wan1 -eq 0 ]] && [[ $both -ne 0 ]]; then
ip r del default
ip r add default nexthop via 192.168.0.254 dev eth0 weight 1 nexthop via 192.168.1.254 dev eth1 weight 1
elif [[ $wan0 -eq 0 ]] && [[ $wan1 -ne 0 ]] && [[ $first -ne 0 ]]; then
ip r del default
ip r add default via 192.168.0.254 dev eth0
elif [[ $wan0 -ne 0 ]] && [[ $wan1 -eq 0 ]] && [[ $second -ne 0 ]]; then
ip r del default
ip r add default via 192.168.1.254 dev eth1
fi
Code: Select all
# chmod 700 /usr/local/bin/dualwan_failover.sh
Code: Select all
*/1 * * * * /usr/bin/setlock -n /tmp/dualwan_failover.lock /usr/local/bin/dualwan_failover.sh > /dev/null 2>&1
