Obsah

uvod

"jen verejna IP adresa" - routovani na zaklade zdrojove adresy

mam router s 2 brany do internetu.. jedna brana ma vetsi bandwidth a druha poskytuje verejnou IP. Chci vyuzit verejnou IP, ale jinak vsechno hnat pres gw s velkym bandwidthem 

# ip route add default via 192.168.1.1 dev ath2 table 10
# ip rule add table 10 from 192.168.1.254
# ip rule
0:	from all lookup local 
32764:	from 192.168.1.254 lookup 10
32766:	from all lookup main 
32767:	from all lookup default

Odkazy:

mam router s 2 brany do internetu.. jedna brana ma vetsi bandwidth a druha poskytuje verejnou IP. Chci vyuzit verejnou IP, ale jinak vsechno hnat pres gw s velkym bandwidthem

tabulka main bude obsahovat normalni routy tabulka 100 bude obsahovat jinou default route 

# ip route
192.168.1.1 dev ath2 
10.10.11.0/25 dev br-lan  src 10.10.11.1 
192.168.1.0/24 dev ath0  src 192.168.1.47 
10.10.15.0/24 dev edge0  src 10.10.15.1 
default via 192.168.1.2 dev ath0
# ip route add default via 192.168.1.1 dev ath2 src 192.168.1.254 table 10
# ip route add default via 192.168.1.2 dev ath0 src 192.168.1.47 table 20
# ip rule add table 10 from 192.168.1.254
# ip rule add table 20 from 192.168.1.47
# ip rule
0:	from all lookup local 
32763:	from 192.168.1.47 lookup 20
32764:	from 192.168.1.254 lookup 10
32766:	from all lookup main 
32767:	from all lookup default 
# ip route show table 10
default via 192.168.1.1 dev ath2  src 192.168.1.254 
# ip route show table 20
default via 192.168.1.2 dev ath0  src 192.168.1.47

zkracene (plne postacuje): 

ip route add default via 192.168.1.1 dev ath2 table 10
ip rule add table 10 from 192.168.1.254

(1) Pouzit multipath routing bez equalize:

ip route add default scope global \
  nexthop via xx.xx.xx.xx
  nexthop via yy.yy.yy.yy

Tohle by predpokladalo, ze mate dve GW – a pri kazdem novem lookupu aplikace dostava stridave prvni a druhou GW: 

for i in 1 2 3 ; do ip route get 91.91.91.$i ; done
91.91.91.1 via A dev eth0  src ...
    cache  mtu 1500 advmss 1460
91.91.91.2 via B dev eth0  src ...
    cache  mtu 1500 advmss 1460
91.91.91.3 via A dev eth0  src ...
    cache  mtu 1500 advmss 1460

Muzete mit samozrejme dve rozhrani a udelat: 

ip route add default scope global \
  nexthop dev eth0 \
  nexthop dev eth1

A pak to vzdy pujde z te adresy, kterou ma to rozhrani. Funguje to jen tak, ze kdyz otevrete novy stream, dostanete stridave prvni a druhou GW. Ne, ze pulka paketu pujde tam a druha jinudy.

(2) Totez s equalize (nutno zapnout v kernelu):

ip route add default equalize ...
ip route add default equalize \
nexthop via XXX.XXX.253.1 dev eth1 \
nexthop via XXX.XXX.253.1 dev eth0

To by melo rozhazovat kazdy packet, lec to tady v jadre nemam, takze to nezkusim.

Jak to udelat s src a jednou sitovkou nevim, bud to zatim nejde, nebo se mi nedari spravne formulovat prikaz pro iproute. 

ip route add default equalize \
nexthop via 192.168.1.2 dev ath0 \
nexthop via 10.10.11.1 dev br-lan
root@OpenWrt:~# ip route show
10.10.11.0/25 dev br-lan  proto kernel  scope link  src 10.10.11.3 
192.168.1.0/24 dev ath0  proto kernel  scope link  src 192.168.1.27 
default equalize 
	nexthop via 192.168.1.2  dev ath0 weight 1
	nexthop via 10.10.11.1  dev br-lan weight 1
root@OpenWrt:~# for i in 1 2 3 ; do ip route get 91.91.91.$i ; done
91.91.91.1 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.2 via 192.168.1.2 dev ath0  src 192.168.1.27 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.3 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
ip route add default equalize \
nexthop via 192.168.1.2 dev ath0 weight 1 \
nexthop via 10.10.11.1 dev br-lan weight 2
ip route add default scope global \
nexthop via 192.168.1.2 dev ath0 \
nexthop via 10.10.11.1 dev br-lan
ip route add default equalize \
nexthop via 10.10.11.1 \
nexthop via 10.10.11.3

rozdil mezi qeui a global scope

nevim rozdil mezi equi.. a global scope… chova se to cudne :)

optimalizace 

  # Enable fast failover of broken gateways links (this isn't a real failover)
  echo "10" > /proc/sys/net/ipv4/route/gc_timeout

nezpozoroval jsem zmenu :( zjistil jsem, ze linka pres gate je asi 2x rychlejsi nez gate2.. proto zkusim 

ip route add default equalize \
nexthop via 192.168.1.2 dev ath0 weight 1 \
nexthop via 10.10.11.1 dev br-lan weight 2
root@OpenWrt:~# for i in `seq 1 10` ; do ip route get 91.91.91.$i ; done
91.91.91.1 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.2 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.3 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.4 via 192.168.1.2 dev ath0  src 192.168.1.27 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.5 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.6 via 192.168.1.2 dev ath0  src 192.168.1.27 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.7 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.8 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.9 via 10.10.11.1 dev br-lan  src 10.10.11.3 
    cache  mtu 1500 advmss 1460 hoplimit 64
91.91.91.10 via 192.168.1.2 dev ath0  src 192.168.1.27 
    cache  mtu 1500 advmss 1460 hoplimit 64

odpojil jsem antenu z gate.. spadl net… odpojil jsem druhou.l. jelo to.. takze se to routuje jen jednou cestou? :( odpovida to tomu, co psal tracert :( ..

hint…. kmod-bonding !!!!!! spojeni interface do jednoho bondig je asi jen proste jedna ip vice rozhrani jedna mac.. napr dve sitovky do switche… dela se virtualni rozhrani na rozdeleni zateze. to by na mono bylo asi idealni. to by stacilo, jenomze bonding chce kernel modul a a v balickach je novy kernel :) lol :) nevim jak predelat na novy kernel :) nebo nevim jak stahnout stare balicky :)

vyzkouset na pharaonu udelat mrourouting :) udelat ten test s GET nejdriv na jednu ip a pak na vice :) mel by se tam ukazat rozdil mezi global a eq :) vubec to nejde :) asi mi chybi nejaky kernel modul :)

proc z gate2 se chodi na net vyhradne pres ath0 a proc z eth0 se chodi vyhradne pres br-lan?

zaver

HomeGuard x Gate2: - smerovani 2 brany

iptables -t mangle -N NEW_OUT_CONN
iptables -t mangle -A PREROUTING -i br-lan -m state --state NEW -j NEW_OUT_CONN
iptables -t mangle -A NEW_OUT_CONN -j CONNMARK --set-mark 0
iptables -t mangle -A NEW_OUT_CONN -m statistic --mode nth --every 2 --packet 0  -j RETURN
iptables -t mangle -A NEW_OUT_CONN -j CONNMARK --set-mark 2
ip route add default via 10.10.11.1 table 1
ip route add default via 192.168.1.2 table 2
ip route show table 1
ip rule add fwmark 2 table 1
ip rule add fwmark 0 table 2 - na tohle to reaguje :) 
ip route show cache
iptables -t mangle -A PREROUTING -j CONNMARK --set-mark 0
iptables -t mangle -A PREROUTING  -m statistic --mode nth --every 2 --packet 0  -j RETURN
iptables -t mangle -A PREROUTING -j CONNMARK --set-mark 2