1

I have a system which can be accessed via SSH and HTTP. The system have two interfaces (eth0, eth1), and is working with Slackware 14.1.

eth0 : 192.168.1.99, LTE Ethernet Gateway/Modem eth1 : 172.16.101.250, Local network (with internet access)

eth1 should be used as default route for outgoing traffic, and automatically switch to eth0 when internet not available via eth1. This part is working using a cron and a script.

The main concern is that when switching default gateway, the ingoing traffic to SSH and HTTP are working only with the interface of the default gateway.

/etc/rc.d/rc.inet1.conf

# Config information for eth0:
IPADDR[0]="192.168.1.99"
NETMASK[0]="255.255.255.0"
USE_DHCP[0]="no"
DHCP_HOSTNAME[0]="bridge"

# Config information for eth1:
IPADDR[1]="172.16.101.250"
NETMASK[1]="255.255.128.0"
USE_DHCP[1]="no"
DHCP_HOSTNAME[1]="bridge"

# Default gateway IP address:
GATEWAY="172.16.0.1"

Script executed every minute to verify internet availability on both networks

#!/bin/bash

DEF_GATEWAY="172.16.0.1"      # Default Gateway
BCK_GATEWAY="192.168.1.1"     # Backup Gateway
RMT_IP_1="8.8.8.8"            # first remote ip
RMT_IP_2="8.8.4.4"            # second remote ip
PING_TIMEOUT="1"              # Ping timeout in seconds

# Check user
if [ `whoami` != "root" ]
then
        echo "Failover script must be run as root!"
        exit 1
fi

# Check GW
CURRENT_GW=`ip route show | grep default | awk '{ print $3 }'`
if [ "$CURRENT_GW" == "$DEF_GATEWAY" ]
then
        ping -c 2 -W $PING_TIMEOUT $RMT_IP_1 > /dev/null
        PING=$?
else
        # Add static routes to remote ip's
        ip route add $RMT_IP_1 via $DEF_GATEWAY
        ip route add $RMT_IP_2 via $DEF_GATEWAY
        ping -c 2 -W $PING_TIMEOUT $RMT_IP_1 > /dev/null
        PING_1=$?
        ping -c 2 -W $PING_TIMEOUT $RMT_IP_2 > /dev/null
        PING_2=$?

        # Del static route to remote ip's
        ip route del $RMT_IP_1
        ip route del $RMT_IP_2
fi

if [ "$PING" == "1" ] && [ "$PING_2" == "1" ]
then
        if [ "$CURRENT_GW" == "$DEF_GATEWAY" ]
        then
                ip route replace default via $BCK_GATEWAY
        fi

elif [ "$CURRENT_GW" != "$DEF_GATEWAY" ]
then
        # Switching to default
        ip route replace default via $DEF_GATEWAY
fi

Here are the services listening

# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 *:http                  *:*                     LISTEN     
tcp        0      0 *:auth                  *:*                     LISTEN     
tcp        0      0 *:ssh                   *:*                     LISTEN     
tcp        0      0 *:https                 *:*                     LISTEN     
tcp        0      0 *:time                  *:*                     LISTEN     
tcp6       0      0 [::]:ssh                [::]:*

Here is the routing table

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         172.16.0.1      0.0.0.0         UG    1      0        0 eth1
loopback        *               255.0.0.0       U     0      0        0 lo
172.16.0.0      *               255.255.128.0   U     0      0        0 eth1
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
5
  • Can you add an example of a connection working as intended, then an example of a connection not working as intended, and what result you would want instead? Also for incoming traffic, something must be made on the router (port forwarding or alike). Is this available on the LTE connection?
    – A.B
    Feb 26, 2020 at 21:30
  • Well when default gateway is 172.16.0.1 I can connect via local network no problem but not via LTE, when default gateway is 192.168.1.1 I can connect via LTE but not via local network. All port forwarding are ok. I suspect a routing issue on the device itself. Feb 26, 2020 at 21:46
  • When, say, default gateway is 172.60.0.1, and you connect via LTE, how do you expect return packets to be routed to LTE, and not to the default gateway? Also keep in mind you'll have NAT somewhere inside both the LTE and the local network. A clean solution to this would be to use TCP Multipath, but it's not in the upstream kernel yet. But if you can choose kernels on all endpoint boxes...
    – dirkt
    Mar 10, 2020 at 18:06
  • Did you test my answer?
    – WGRM
    Mar 17, 2020 at 18:08
  • @AlexandreLavoie ?
    – WGRM
    Mar 18, 2020 at 16:29

2 Answers 2

0

When you say ingoing do you mean connections from remote internet clients that have been opened to an SSH (or HTTP) service on your local host?

If so, what are the external IP addresses? I'm assuming they are different for each interface. In this case you also may have issues with timeouts for NAT entries and NAT connections, depending on your gateway routers.

You cannot control the external public routing for incoming connections, especially once they are opened. If you lose connectivity for a given interface then all connections to it will timeout (unless sometimes when the connection and routing are restored before the timeout).

If you can control the DNS used by remote clients to connect to your (e.g.) SSH service then you maybe can have some reasonable control over which IP they use for new connections, within some reasonable time between fail-overs, e.g. a minimum of 300 seconds after you advertise the new IP you can expect clients to begin using it.

0

I'm not 100% sure, but... You have two NICs and every has its own net. If your "Default Gateway" is set to 192.168.1.1/24, the 172.16.0.0/17 won't be allowed to reach the former. This is a feature which must be enabled/permitted. You traverse networks, you are talking about routing. So either set the following setting or setup a bridge:

echo 1 > /proc/sys/net/ipv4/ip_forward

And if it works, make it permanent with:

/etc/sysctl.conf:
net.ipv4.ip_forward = 1
sysctl -p /etc/sysctl.conf
service network restart

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .