Skip to main content

How To: Load Balancing & Failover With Dual/ Multi WAN / ADSL / Cable Connections on Linux

Requirements for Load Balancing multiple ADSL / Cable Connections

1. Obviously you need to have multiple (A)DSL or Cable connections in the first place. Login as root for this job.
2. Find out the LAN / internal IP address of the modems. They may be same like 1921.168.1.1.

Check if the internal / LAN IP address of both (or multiple) modems are same. In that use the web / telnet interface of the modems to configure one of the modems to have a different internal IP address preferably in different networks like 192.168.0.1 or 192.168.2.1 etc. If you are using multiple modems then you should configure each of them to have different subnets. This is important because now you can easily access the different modems from their web interface and you don't have to bother connecting to a modem through a particular interface. It is also important because now you can easily configure the interfaces to be associated with different netmasks / sub-network.
3. Connect each modem to the computer using a different interface (eth0, eth1 etc.). You may be able to use the same interface but this guide doesn't cover that. In short you will make your life complicated using the same interface or even different virtual interface. My recommendation is that you should use one interface per modem. Don't scrimp on cheap ethernet adapters. This has the added benefit of redundancy should one adapter go bad down the road.
4. Configure the IP address of each interface to be in the same sub-network as the modem. For example my modems have IP addresses of 192.168.0.1 and 192.168.1.1. The corresponding addresses & netmasks of the interfaces are: 192.168.0.10 (netmask: 255.255.255.0) and 192.168.1.10 (netmask: 255.255.255.0).
5. Find out the following information before you proceed with the rest of the guide:
  1. IP address of external interfaces (interfaces connected to your modems). This is not the gateway address.
  2. Gateway IP address of each broadband connections. This is the first hop gateway, could be your DSL modem IP address if it has been configured as the gateway following the tip below.
  3. Name, IP address & netmask of external interfaces like eth1, eth2 etc. My external interfaces are eth1 & eth2.
  4. Relative weights you want to assign to each connection. My Tata connection is 4 times faster than BSNL connection. So I assign the weight of 4 to Tata and 1 to BSNL. You must use low positive integer values for weights. For same connection speeds weights of 1 & 1 are appropriate. The weights determine how the load is balanced across multiple connections. In my case Tata is 4 times as likely to be used as route for a particular site in comparison with BSNL.
Note: Refer to Netmask guide for details on netmasks.
Optional step

Check the tips on configuring (A)DSL modems. They are not required for using this guide. However they are beneficial in maximizing your benefits.

How to setup default load balancing for multiple ADSL / Cable connections

Unlike other guides on this topic I will use a real example - the configuration on our internal network. So to begin with here are the basic data for my network:
#IP address of external interfaces. This is not the gateway address.

IP1=192.168.1.10

IP2=192.168.0.10
#Gateway IP addresses. This is the first (hop) gateway, could be your router IP

#address if it has been configured as the gateway

GW1=192.168.1.1

GW2=192.168.0.1
# Relative weights of routes. Keep this to a low integer value. I am using 4

# for TATA connection because it is 4 times faster

W1=1

W2=4
# Broadband providers name; use your own names here.

NAME1=bsnl

NAME2=tata
You must change the example below to use your own IP addresses and other details. Even with that inconvenience a real example is much easier to understand than examples with complex notations. The example given below is copy-pasted from our intranet configuration. It works perfectly as advertised.
Note: In this step fail-over is not addressed. It is provided later with a script which runs on startup.
First you need to create two (or more) routes in the routing table ( /etc/iproute2/rt_tables ). Open the file and make changes similar to what is show below. I added the following for my two connections:



1 bsnl

2 tata

To add a default load balancing route for our outgoing traffic using our dual internet connections (ADSL broadband connections from BSNL & Tata Indicom) here are the lines I included in rc.local file:



ip route add 192.168.1.0/24 dev eth1 src 192.168.1.10 table bsnl

ip route add default via 192.168.1.1 table bsnl

ip route add 192.168.0.0/24 dev eth2 src 192.168.0.10 table tata

ip route add default via 192.168.0.1 table tata

ip rule add from 192.168.1.10 table bsnl

ip rule add from 192.168.0.10 table tata

ip route add default scope global nexthop via 192.168.1.1 dev eth1 weight 1 nexthop via 192.168.0.1 dev eth2 weight 4

Adding them to rc.local ensures that they are execute automatically on startup. You can also run them manually from the command line.
This completes the load balancing part. Let's now see how we can achieve fail-over so the routes are automatically changed when one or more connections are down and then changed again when one or more more connections come back up again. To do this magic I used a script.

How to setup fail-over over multiple load balanced ADSL / Cable connections

Please follow the steps below and preferably in the same order:
  1. First download the script which checks for and provides fail-over over dual ADSL / Cable internet connections and save it to /usr/sbin directory (or any other directory which is mounted available while loading the OS).
  2. Change the file permissions to 755:

    chmod 755 /usr/sbin/gwping
  3. Open the file (as root) in an editor like vi or gedit and edit the following parameters for your environment:

    #IP Address or domain name to ping. The script relies on the domain being pingable and always available

    TESTIP=www.yahoo.com
    #Ping timeout in seconds

    TIMEOUT=2
    # External interfaces

    EXTIF1=eth1

    EXTIF2=eth2
    #IP address of external interfaces. This is not the gateway address.

    IP1=192.168.1.10

    IP2=192.168.0.10
    #Gateway IP addresses. This is the first (hop) gateway, could be your router IP

    #address if it has been configured as the gateway

    GW1=192.168.1.1

    GW2=192.168.0.1
    # Relative weights of routes. Keep this to a low integer value. I am using 4

    # for TATA connection because it is 4 times faster

    W1=1

    W2=4
    # Broadband providers name; use your own names here.

    NAME1=BSNL

    NAME2=TATA
    #No of repeats of success or failure before changing status of connection

    SUCCESSREPEATCOUNT=4

    FAILUREREPEATCOUNT=1
    Note: Four consecutive success indicates that the gateway is up and one (consecutive) failure indicates that the gateway went down for my environment. You may want to modify it to better match your environment.
  4. Add the following line to the end of /etc/rc.local file:

    nohup /usr/sbin/gwping &
In the end my /etc/rc.local file has the following lines added in total:
ip route add 192.168.1.0/24 dev eth1 src 192.168.1.10 table bsnl

ip route add default via 192.168.1.1 table bsnl

ip route add 192.168.0.0/24 dev eth2 src 192.168.0.10 table tata

ip route add default via 192.168.0.1 table tata

ip rule add from 192.168.1.10 table bsnl

ip rule add from 192.168.0.10 table tata

ip route add default scope global nexthop via 192.168.1.1 dev eth1 weight 1 nexthop via 192.168.0.1 dev eth2 weight 4

nohup /usr/sbin/gwping &
An astute reader may note that the default setup with dual load balanced routing (7th line) is really not required as the script is configured to force routing based on the current status the very first time. However it is there to ensure proper routing before the script forces the routing for the first time which is about 40 seconds in my setup (can you tell why it takes 40 second for the first time?).

Comments

Popular posts from this blog

ipsec tunnel pfSense and Centos

pfSense 1.2.3 -------- external ip: 1.1.1.1 internal ip: 172.20.1.20 internal network: 172.20.1.0/24 Centos 5.5 -------- external ip: 2.2.2.2 internal ip: 172.20.2.1 internal network: 172.20.2.0/24 pfSense config from a reset. Firewall rule to allow all ipsec communication (all protocols). pfSense ipsec config -------------------- Mode: Tunnel Interface: WAN (I'm not sure this should be WAN, but changing it to LAN makes no difference) Local subnet: 172.20.1.0/24 Remote subnet: 172.20.2.0/24 Remote gateway: 2.2.2.2 Phase 1 Negotiation mode: agressive My identifier: My IP adress Encryption algorithm: 3DES Hash algorithm: SHA1 DH key group: 2 Authentication method: Pre-shared key Pre-Shared Key: secret Phase 2 Protocol: ESP Encryption algorithms: Rijndael (AES) Hash algorithms: SHA1 PFS key group: 2   Centos ipsec config ------------------- /etc/sysconfig/network-scripts/ifcfg-ipsec0 TYPE=IPSEC ...

Endian Firewall

With perilous threats from crackers and script kiddes lurking in the network, IT administrators could do no better than placing a firewall protection. Firewall prevents unwanted access to departmental systems while preventing local systems from attacking systems on the other network. It ensures that the traffic entering and leaving the secured LAN is accessing the correct applications on the correct computers. We had already done with the top free Windows firewall. However, there is cool open source firewall to take advantage of. Open source firewall not only offers better customization options, but also reduces the cost of ownership. After a comprehensive search we assorted the top 10 open source firewall. 1. Endian Firewall This is an open source firewall based on the IPCop Linux Firewall. It is one of the most widely used open source firewall with comprehensive features. It is almost an opensource Universal threat Management (UTM) device with a Statefull firewall, VPN, Webpro...

Typical Oracle RAC configurations

All configurations are based on the following building blocks: Hardware Server nodes Storage Networking Software Operating system Cluster software Oracle RAC (application) Application architecture Oracle9i RAC on RAW devices is based on a shared disk architecture. Figure 2-1 shows a two-node cluster. The lower solid line is the primary Oracle interconnect, the middle dashed line is the secondary Oracle interconnect. For high availability, both these networks should be defined in the HACMP as "private". HACMP/ESCRM provides Oracle9i RAC with the infrastructure for concurrent access to disks. Although HACMP provides concurrent access and a disk locking mechanism, this mechanism is not used. Oracle, instead, provides its own locking mechanism for concurrent data access, integrity, and consistency. Volume groups are varied on all the nodes, thus ensuring short failover time. This type of concurrent access can only be provided for RAW ...