2 Apr 2006 17:05
Re: multiple isp. masqueraded machines somtimes work and sometimes not
Anuj Singh <anujhere <at> gmail.com>
2006-04-02 15:05:03 GMT
2006-04-02 15:05:03 GMT
Hiii!
After working on the problem I found that one of the dns entry was wrong (This is a remote network and basic configuratins were done by some other) ... after entering the proper nameserves I checked the performance and so far there is no problem with both the isp's working.
now about ip failover I tried this script: called switch.sh
#vi switch.sh
ISP1=61.95.234.1
ISP2=59.144.170.1
switch_dsl()
{
route del default
route add default gw $ISP2
}
switch_cable()
{
route del default
route add default gw $ISP1
}
if ping -c1 -q www.yahoo.com >/dev/null 2>&1; then
echo Gateway is alive.
ip route show
exit 0
else
if route -n | grep '^0.0.0.0' | grep "$ISP1"; then
switch_dsl
ip route flush cache
shorewall restart /shorewall2
route -n
else
switch_cable
fi
fi
The os is suse and I am still working on making a daemon on it. At the moment I added it's entry in the crontab to run in every 5 minutes.
I found that if i add my shorewall restart it again changes the default gateway to the 1st ISP defined in /etc/shorewall/providers file. which is unplugged ot not working ( it still works for a while .. probably due to ip route cache)
now to make it switching properly between the gateways I copied the whole /etc/shorewall directory to a different location say /shorewall2 with a change in providers file ...i.e. i defined just oppsite ISP's (changed 1st isp to 2 and 2nd ISP to 1)
#NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY
OPTIONS COPY
ISP1 1 1 main eth0 59.144.170.1
track,balance eth2
ISP2 2 2 main eth1 61.95.234.1
track,balance eth2
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
and defined it in my script (showed above in the script with directory /shorewall2 )now it was switching the ISP's but i found it not working for local network...
By default after a shorewall restart command it makes default gw= ISP1 in providers file.
In the last I made another change in the script is to make it to only chane the gateway and no shorewall restart. this time the internet was working on local network. Just checkd for few minutes after flushing the ip route cache.
#!/bin/sh
ISP1=61.95.234.1
ISP2=59.144.170.1
switch_dsl()
{
route del default
route add default gw $ISP2
}
switch_cable()
{
route del default
route add default gw $ISP1
}
if ping -c5 -q www.yahoo.com >/dev/null 2>&1; then
echo Gateway is alive.
ip route show
exit 0
else
if route -n | grep '^0.0.0.0' | grep "$ISP1"; then
switch_dsl
ip route flush cache
#shorewall restart /shorewall2
route -n
else
switch_cable
fi
fi
Tomorrow the load on the network will be full and going to check the performance.
Tom I would like to check other scripts too....if you can provide the links or more details related to ip failover.
I will update with more....
Thanks and regards
Anuj
On 3/28/06, Tom Eastep <teastep <at> shorewall.net> wrote:
On Mon, March 27, 2006 10:23, Anuj Singh wrote:
> Yes both are connected to the same switch.
That's your answer. If the two interfaces are on different IP networks and
you do not use Proxy ARP, it will be sufficient to specify 'arp_ignore=1'
on both interfaces (/etc/shorewall/interfaces). They cannot be on the same
IP network and you cannot use Proxy ARP with that physical network
topology without using ebtables. You will probably have to restart your
firewall after making this change to get the upstream router(s) to get the
correct ARP information.
>
> About the ip failover
Other folks have posted similar scripts, although most run the script as a
daemon rather than scheduling it via cron.
-Tom
--
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ teastep <at> shorewall.net
PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmdlnk&kid
.
Second, this message is "kinda" BIG, so if you don't like BIG
messages, simply don't read it 
Extended MARK Target: Not available
CONNMARK Target: Not available
^^^^^^^^^^^^ -- so "track" option in the /etc/shorewall/providers
also not for me 
RSS Feed