21
Company LOGO www.getclouder.com Run Two ISPs in Your Home (Multihomed Router) Marian (HackMan ) Marinov CEO of 1H Ltd. CTO of GetClouder Ltd.
Company LOGO
www.getclouder.com
Run Two ISPs in Your Home (Multihomed Router)
Marian (HackMan) MarinovCEO of 1H Ltd.CTO of GetClouder Ltd.
www.getclouder.com
What is a multi-homed router?
Chapter 1
Multihoming
www.getclouder.com
Why multihoming?
• Failover
• More capacity
• Faster connections
• Cheaper connections
• Why not both?
Chapter 1
Multihoming
www.getclouder.com
Assumptions
• You already know how routing is done on the Internet
• You know what are the iptables tables• filter
• mangle
• nat
• You already know what NAT is and how it works
• Forwarding is enabled and allowed in the router
Chapter 1
Multihoming
www.getclouder.com
Usual setup
main routing table10.0.0.0/24 dev eth2 src 10.0.0.177.70.33.0/24 dev eth0 src 77.70.33.12default via 77.70.33.1 dev eth0
iptables -t nat -A POSTROUTING -j SNAT \ -s 10.0.0.0/24 -o eth0 --to 77.70.33.12
Chapter 2
Setup
www.getclouder.com
Multiple routing tables
ISP1: 10.0.0.0/24 dev eth2 src 10.0.0.1 77.70.33.0/24 dev eth0 src 77.70.33.12 default via 77.70.33.1 dev eth0ISP2: 10.0.0.0/24 dev eth2 src 10.0.0.1 83.12.21.0/24 dev eth1 src 83.15.21.65 default via 83.15.21.254 dev eth1
Chapter 2
Setup
www.getclouder.com
Multiple routing tables
Chapter 2
Setup
routing table
www.getclouder.com
Multiple routing tables
Chapter 2
Setup
routing table ISP1
routing table ISP2
www.getclouder.com
How to create iproute2 routing tables
Chapter 2
Setup
$ cat /etc/iproute2/rt_tables# reserved values255 local254 main253 default10 isp120 isp20 unspec
www.getclouder.com
How to add routes into the new routing tables
Chapter 2
Setup
ip r a 10.0.0.0/24 dev eth2 t isp1ip r a 10.0.0.0/24 dev eth2 t isp2
ip r a 77.70.33.0/24 dev eth0 t isp1ip r a 0/0 via 77.70.33.1 t isp1
ip r a 83.12.21.0/24 dev eth0 t isp2ip r a 0/0 via 83.15.21.254 t isp2
ip r a == ip route add t == table
www.getclouder.com
How to guide the traffic to enter these tables
Chapter 2
Setup
ip ru a from 77.70.33.12 t isp1 ip ru a from 83.15.21.65 t isp2
ip ru a == ip rule add t == table
www.getclouder.com
Separating the clients from the home network
Chapter 2
Separation
• Manually• based on source IP
• based on destination IP
• based on protocols
• Automatic• statistic (random,nth)
• recent
• time based
• Route based
www.getclouder.com
Manually separating clients
Chapter 2
Separation
• based on source IPip rule add from 10.0.0.x table isp1
• based on destination IPip rule add to 192.168.0.x table isp1
• based on protocolsiptables marking per protocol
www.getclouder.com
CONNMARK
Chapter 2
Separation
iptables -A POSTROUTING -t mangle -j CONNMARK --restore-markiptables -A POSTROUTING -t mangle -m mark ! --mark 0 -j ACCEPTiptables -A POSTROUTING -p tcp --dport 21 -t mangle -j MARK --set-mark 1iptables -A POSTROUTING -p tcp --dport 80 -t mangle -j MARK --set-mark 2iptables -A POSTROUTING -t mangle -j CONNMARK --save-mark
Automatically separate clients between uplinks
● Statistic
iptables -t mangle -A PREROUTING -j MARK --set-mark 2 -o dev_ips2 -m statistic --mode random --probability 0.2
iptables -t mangle -A PREROUTING -j MARK --set-mark 1 -o dev_ips1 -m statistic --mode nth --every 2 --packet 0
iptables -t mangle -A PREROUTING -j MARK --set-mark 2 -o dev_ips2 -m statistic --mode nth --every 2 --packet 1
Automatically separate clients between uplinks
● Statistic
-j MARK --set-mark 1 -o dev_ips1 -m statistic --mode nth --every 4 --packet 0
-j MARK --set-mark 1 -o dev_ips1 -m statistic --mode nth --every 4 --packet 1
-j MARK --set-mark 1 -o dev_ips1 -m statistic --mode nth --every 4 --packet 2
-j MARK --set-mark 2 -o dev_ips2 -m statistic --mode nth --every 4 --packet 3
Automatically separate clients between uplinks
● recent
-m recent --name ballanced --rcheck --seconds 300 -j MARK --set-mark 2
-m recent --name ballanced --set -j MARK --set-mark 1● time based
-m time --timestart 09:30 --timestop 17:30 --days Mon,Tue,Wed,Thu,Fri
Automatically separate clients between uplinks
● route based
ip route add default scope global \
nexthop via $gw_isp1 dev $dev_isp1 weight 1 \
nexthop via $gw_isp2 dev $dev_isp2 weight 1
www.getclouder.com
Source NAT - Set the outgoing IPs
iptables -t nat -A POSTROUTING \ -o $dev_isp1 -j SNAT --to $ip_isp1iptables -t nat -A POSTROUTING \ -o $dev_isp2 -j SNAT --to $ip_isp2
SNAT
Chapter 3
www.getclouder.com
Additional documentation
http://lartc.org/howto/lartc.rpdb.multiple-links.htmlLink Status Monitor http://lsm.foobar.fi/If you are interested... Julian Anastasov's patches: http://www.ssi.bg/~ja/#routes
Chapter 4
Conclusion
www.getclouder.com
Q & A
Marian (HackMan) Marinovmm <> 1h.com
Jabber: [email protected] HackMan #iseca #softuni
Chapter 5
Questions
