Dual WAN with one as standby backup

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 01:46, 15 February 2007 (edit)
Whiteboy (Talk | contribs)
(Dual-WAN for simple round-robin load equalization)
← Previous diff
Current revision (17:57, 18 March 2018) (edit) (undo)
Ian5142 (Talk | contribs)
(Changed Category to Dual WAN)
 
(6 intermediate revisions not shown.)
Line 1: Line 1:
article need of major revision - one with dual wan as backup another simple round equalization article need of major revision - one with dual wan as backup another simple round equalization
-= Dual WAN with one as standby backup = 
This tutorial explains how you can assign one (or more) of the LAN ports This tutorial explains how you can assign one (or more) of the LAN ports
as an extra WAN port. There is another tutorial as an extra WAN port. There is another tutorial
-[[Dual-WAN_for_simple_round-robin_load_equalization]] +[[Dual-WAN for simple round-robin load equalization]]
which explains how you can load balance between the two WAN connections. which explains how you can load balance between the two WAN connections.
In this case I did not want to load balance; but rather create a standby WAN In this case I did not want to load balance; but rather create a standby WAN
connection. connection.
-=== Justification ===+== Justification ==
I needed to configure backup WAN as standby as it is not an unlimited I needed to configure backup WAN as standby as it is not an unlimited
connection. I pay for the backup connections by Giga-Bytes used. My primary connection. I pay for the backup connections by Giga-Bytes used. My primary
Line 15: Line 14:
the primary one goes down. the primary one goes down.
-=== Assumptions ===+== Assumptions ==
I have assumed static IP addresses for both the WAN interfaces. Making them I have assumed static IP addresses for both the WAN interfaces. Making them
-dynamic will require some changes (hint nvram set wan2_proto=dynamic)+dynamic will require some changes (hint: <code>nvram set wan2_proto=dynamic</code>)
Also, I am assuming DNSMasq is used for DHCP and DNS. JFFS should be enabled Also, I am assuming DNSMasq is used for DHCP and DNS. JFFS should be enabled
if you want to save the WAN-connection switch scripts. Also, I am assuming that you if you want to save the WAN-connection switch scripts. Also, I am assuming that you
Line 24: Line 23:
or web interface. or web interface.
-=== Create an extra VLAN ===+== Create an extra VLAN ==
First you need to create an extra VLAN. In this case we want to to remove First you need to create an extra VLAN. In this case we want to to remove
the port 4 from vlan0 and add it to the new vlan2 the port 4 from vlan0 and add it to the new vlan2
-nvram set vlan0ports="1 2 3 5*" <br>+ nvram set vlan0ports="1 2 3 5*"
-nvram set vlan2ports="4 5" <br>+ nvram set vlan2ports="4 5"
-nvram set vlan2hwname=et0 <br>+ nvram set vlan2hwname=et0
-nvram set wan2_ifnames=vlan2 <br>+ nvram set wan2_ifnames=vlan2
-nvram set wan2_ifname=vlan2 <br>+ nvram set wan2_ifname=vlan2
-nvram set wan2_mtu=1500 <br>+ nvram set wan2_mtu=1500
-nvram commit <br>+ nvram commit
You can confirm or perform the setting using the dd-wrt web interface You can confirm or perform the setting using the dd-wrt web interface
Line 42: Line 41:
Now you have created an extra VLAN (vlan2). Now you have created an extra VLAN (vlan2).
-=== Bring up the vlan2 Interface ===+== Bring up the vlan2 interface ==
I found it easier to configure the interface using ifconfig in the startup script. I found it easier to configure the interface using ifconfig in the startup script.
Somehow nvram bindings for backup WAN interface IP address did not work. ifconfig Somehow nvram bindings for backup WAN interface IP address did not work. ifconfig
Line 63: Line 62:
http://your_router_ip/Diagnostics.asp http://your_router_ip/Diagnostics.asp
-Ofcourse you will need a reboot for this to be effective +Of course you will need a reboot for this to be effective.
-=== Configure NAT on vlan2 ===+== Configure NAT on vlan2 ==
We want to make sure packets leaving vlan2 are NATed We want to make sure packets leaving vlan2 are NATed
Line 73: Line 72:
' '
</pre> </pre>
-Again the same Diagnostics.asp page can be used on the web interface 
 +Again, the same Diagnostics.asp page can be used on the web interface.
-=== Ctreate scripts to do the connection switch ===+== Create scripts to do the connection switch ==
We switch the internet connection by switching the default route and DNS servers. We switch the internet connection by switching the default route and DNS servers.
-Here we will create 2 scripts in /jffs to switch from one WAN connection+Here we will create two scripts in /jffs to switch from one WAN connection to the other.
-to the other+
-script to switch to wan1+=== Script to switch to wan1 ===
-put this in /jffs/activate.wan1+Put this in <code>/jffs/activate.wan1</code>:
<pre> <pre>
#!/bin/ash #!/bin/ash
Line 93: Line 91:
echo "nameserver 10.10.1.10" > /tmp/resolv.dnsmasq echo "nameserver 10.10.1.10" > /tmp/resolv.dnsmasq
echo "nameserver 10.10.1.11" >> /tmp/resolv.dnsmasq echo "nameserver 10.10.1.11" >> /tmp/resolv.dnsmasq
-pr="$(ps | grep dnsmasq | grep -v grep| awk '{print $1}')"+pr="$(ps | awk '/dnsmasq/ {print $1}')"
kill -9 $pr kill -9 $pr
-dnsmasq --conf-file /tmp/dnsmasq.conf &+dnsmasq --conf-file /tmp/dnsmasq.conf
</pre> </pre>
 +
Used kill -9; because not sure why -1 (HUP) didnt work. Used kill -9; because not sure why -1 (HUP) didnt work.
-Obviously 10.10.1.10 and 10.10.1.11 are DNS servers for WAN1 and 10.10.1.1 is the default gateway. Replace these values with your own settings for WAN1+Obviously 10.10.1.10 and 10.10.1.11 are DNS servers for WAN1 and 10.10.1.1 is the default gateway. Replace these values with your own settings for WAN1.
-And put this in /jffs/activate.wan2+=== Script to switch to wan2 ===
-<pre>+And put this in <code>/jffs/activate.wan2</code>:
-#!/bin/ash+ 
 +<pre>#!/bin/ash
nvram set wan_dns="10.10.2.10 10.10.2.11" nvram set wan_dns="10.10.2.10 10.10.2.11"
route delete default route delete default
Line 115: Line 115:
dnsmasq --conf-file /tmp/dnsmasq.conf & dnsmasq --conf-file /tmp/dnsmasq.conf &
</pre> </pre>
-Obviously 10.10.2.10 and 10.10.2.11 are DNS servers for WAN2 and 10.10.2.1 is the default gateway. Replace these values with your own settings for WAN2 
-You can switch connection by running the respective script+Obviously 10.10.2.10 and 10.10.2.11 are DNS servers for WAN2 and 10.10.2.1 is the default gateway. Replace these values with your own settings for WAN2.
-=== Connect the cable ===+You can switch connection by running the respective script.
 + 
 +Connect the cable
Connect the backup WAN cable to the ethernet port marked as "4" and reboot. Connect the backup WAN cable to the ethernet port marked as "4" and reboot.
 +== More to come ==
-=== More to come === 
# Automation of connection switching with email notification # Automation of connection switching with email notification
# Web interface to monitor and switch connection # Web interface to monitor and switch connection
 +== See also ==
 +* [[Dual-WAN for simple round-robin load equalization]]
 +* [[Dual WAN with failover]]
-= Dual-WAN for simple round-robin load equalization =+[[Category:Dual WAN]]
-(copied from forum-posting by user aldoir [http://forum.bsr-clan.de/ftopic8012.html Dual-WAN forum posting]+
- +
-You'll need to create a new VLAN, called vlan2.+
- +
-Enter in the web interface, Settings/VLANs. Set Port 4 to a new VLAN.+
- +
-Enter in the console, and do the following commands+
- +
-'''commands to set VLANs'''+
-<pre>+
-nvram set vlan0ports="1 2 3 5*"+
-nvram set vlan2ports="4 5"+
-nvram set vlan2hwname=et0+
-nvram commit+
-</pre>+
- +
-Here are the scripts I used to startup the interface. You need to call them in rc_firewall+
- +
-'''wan2.firewall'''+
- +
-//edit - dont like this bit, it doesnt seem to be for DHCP connection and looks like its for a static IP connection+
-<pre>+
-#!/bin/sh+
-WAN2_IFNAME=vlan2+
-WAN2_IPADDR=10.0.0.2+
-WAN2_GATEWAY=10.0.0.1+
-WAN2_NETMASK=255.0.0.0+
-if [ "$(nvram get wan2_ipaddr)" != "$WAN2_IPADDR" ]; then+
- nvram set wan2_ifname=$WAN2_IFNAME +
- nvram set wan2_ipaddr=$WAN2_IPADDR+
- nvram set wan2_gateway=$WAN2_GATEWAY+
- nvram set wan2_netmask=$WAN2_NETMASK+
- nvram commit+
-fi+
-ifconfig $(nvram get wan2_ifname) up $(nvram get wan2_ipaddr) netmask $(nvram get wan2_netmask)+
-</pre>+
- +
-'''routes.firewall'''+
-<pre>+
-#!/bin/sh+
-ip rule flush+
-ip rule add lookup main prio 32766+
-ip rule add lookup default prio 32767+
-ip rule add from $(nvram get wan_ipaddr) table 100 prio 100+
-ip rule add fwmark 0x100 table 100 prio 101+
-ip rule add from $(nvram get wan2_ipaddr) table 200 prio 200+
-ip rule add fwmark 0x200 table 200 prio 201+
-ip route flush table 100+
-ip route flush table 200+
-for TABLE in 100 200+
-do+
- ip route | grep link | while read ROUTE+
- do+
- ip route add table $TABLE to $ROUTE+
- done+
-done+
-ip route add table 100 default via $(nvram get wan_gateway)+
-ip route add table 200 default via $(nvram get wan2_gateway)+
-</pre>+
- +
-'''firewall.firewall'''+
-<pre>+
-#!/bin/sh+
-#DD-WRT firewall rules+
-#BEGIN+
-#apply simple forward rules+
-for RULE in $(nvram get forward_spec)+
-do+
- FROM=`echo $RULE | cut -d '>' -f 1`+
- TO=`echo $RULE | cut -d '>' -f 2`+
- STATE=`echo $FROM | cut -d ':' -f 2`+
- PROTO=`echo $FROM | cut -d ':' -f 3`+
- SPORT=`echo $FROM | cut -d ':' -f 4`+
- DEST=`echo $TO | cut -d ':' -f 1`+
- DPORT=`echo $TO | cut -d ':' -f 2`+
- if [ "$STATE" = "on" ]; then+
- if [ "$PROTO" = "both" ]; then+
- #udp+
- #iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p udp --dport $SPORT -j ACCEPT+
- iptables -A PREROUTING -t nat -p udp -d $(nvram get wan2_ipaddr) --dport $SPORT -j DNAT --to $DEST:$DPORT+
- #tcp+
- #iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p tcp --dport $SPORT -j ACCEPT+
- iptables -A PREROUTING -t nat -p tcp -d $(nvram get wan2_ipaddr) --dport $SPORT -j DNAT --to $DEST:$DPORT+
- else+
- #iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p $PROTO --dport $SPORT -j ACCEPT+
- iptables -A PREROUTING -t nat -p $PROTO -d $(nvram get wan2_ipaddr) --dport $SPORT -j DNAT --to $DEST:$DPORT+
- fi+
- fi+
-done+
-#apply range forward rules+
-for RULE in $(nvram get forward_port)+
-do+
- FROM=`echo $RULE | cut -d '>' -f 1`+
- TO=`echo $RULE | cut -d '>' -f 2`+
- STATE=`echo $FROM | cut -d ':' -f 2`+
- PROTO=`echo $FROM | cut -d ':' -f 3`+
- SPORT=`echo $FROM | cut -d ':' -f 4`+
- EPORT=`echo $FROM | cut -d ':' -f 5`+
- +
- if [ "$STATE" = "on" ]; then+
- if [ "$PROTO" = "both" ]; then+
- #udp+
- #iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p udp --dport $SPORT:$EPORT -j ACCEPT+
- iptables -A PREROUTING -t nat -p udp -d $(nvram get wan2_ipaddr) --dport $SPORT:$EPORT -j DNAT --to $TO+
- #tcp+
- #iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p tcp --dport $SPORT:$EPORT -j ACCEPT+
- iptables -A PREROUTING -t nat -p tcp -d $(nvram get wan2_ipaddr) --dport $SPORT:$EPORT -j DNAT --to $TO+
- else+
- #iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p $PROTO --dport $SPORT:$EPORT -j ACCEPT+
- iptables -A PREROUTING -t nat -p $PROTO -d $(nvram get wan2_ipaddr) --dport $SPORT:$EPORT -j DNAT --to $TO+
- fi+
- fi+
-done+
-iptables -A PREROUTING -t nat -p icmp -d $(nvram get wan2_ipaddr) -j DNAT --to $(nvram get lan_ipaddr)+
-if [ $(nvram get remote_management) -eq 1 ]; then+
- iptables -A PREROUTING -t nat -p tcp -d $(nvram get wan2_ipaddr) \+
- --dport $(nvram get http_wanport) -j DNAT --to $(nvram get lan_ipaddr):$(nvram get http_lanport)+
-fi+
-if [ $(nvram get dmz_enable) -eq 1 ]; then+
- DMZ_IP=$(nvram get lan_ipaddr | sed -r 's/[0-9]+$//')$(nvram get dmz_ipaddr)+
- iptables -A PREROUTING -t nat -d $(nvram get wan2_ipaddr) -j DNAT --to $DMZ_IP+
-fi+
-iptables -A PREROUTING -t nat --dest $(nvram get wan2_ipaddr) -j TRIGGER --trigger-type dnat+
-iptables -A FORWARD -i $(nvram get wan2_ifname) -o $(nvram get lan_ifname) -j TRIGGER --trigger-type in+
-iptables -A PREROUTING -t mangle -i $(nvram get wan2_ifname) -j IMQ --todev 0+
-iptables -A PREROUTING -t mangle -i $(nvram get wan2_ifname) -j SVQOS_IN+
-iptables -A POSTROUTING -t mangle -o $(nvram get wan2_ifname) -j SVQOS_OUT+
-#DD-WRT END+
-#Save the gateway in the connection mark for new incoming connections+
-iptables -t mangle -A PREROUTING -i $(nvram get wan_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100+
-iptables -t mangle -A PREROUTING -i $(nvram get wan2_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x200+
-# Save the gateway in the connection mark for new outgoing connections+
-iptables -t mangle -A POSTROUTING -o $(nvram get wan_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100+
-iptables -t mangle -A POSTROUTING -o $(nvram get wan2_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x200+
-# Use the correct gateway for reply packets from the LAN+
-iptables -t mangle -A PREROUTING -i $(nvram get lan_ifname) -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark+
-# Use the correct gateway for reply packets from local connections+
-iptables -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark+
-#mask known packets to its source address+
-iptables -A POSTROUTING -t nat -m mark --mark 0x100 -j SNAT --to-source $(nvram get wan_ipaddr)+
-iptables -A POSTROUTING -t nat -m mark --mark 0x200 -j SNAT --to-source $(nvram get wan2_ipaddr)+
-#permit access to wan2+
-iptables -A POSTROUTING -t nat -j MASQUERADE -o $(nvram get wan2_ifname)+
-#restore-mark is done in PREROUTING. If restored again, will loose the outgoing marks+
-iptables -t mangle -D SVQOS_OUT -j CONNMARK --restore-mark 2> /dev/null+
-#iptables -t mangle -A PREROUTING -i $(nvram get lan_ifname) -m multiport -p tcp --dport 22,25,80,110,119,143,443,993,3389 -j MARK --set-mark 0x100+
-#use WAN1 for common navigation, WAN2 for P2P traffic and others+
-#iptables -t mangle -I PREROUTING -i $(nvram get lan_ifname) -s 192.168.1.100 -j MARK --set-mark 0x200+
-#iptables -t mangle -I PREROUTING -i $(nvram get lan_ifname) -s 192.168.1.100 -j LOG --log-prefix 'P2P: '+
-RP_PATH=/proc/sys/net/ipv4/conf+
-for IFACE in `ls $RP_PATH`; do+
- echo 0 > $RP_PATH/$IFACE/rp_filter+
-done+
-</pre>+
- +
-Once everything works, you should use the command ' ip route equalize' (search with Google for the syntax) to balance the load, or do a -j MARK --set-mark 0xN00 via iptables to redirect your traffig to WAN1 (0x100) or WAN2 (0x200)+
- +
-If you need further assistance, post in forums or [http://www.dd-wrt.com/phpBB2/privmsg.php?mode=post&u=567 PM]-me+
- +
-The firewall scripts does not yet implement the full DD-WRT firewall, only the basic port/range forwarding.+
- +
-This is script works for both outgoing AND incoming connections (most scripts only treats outgoing), so you should be able to accept connections in both links simultaneous (eg. web in one and FTP in another).+
- +
- +
-[[Category:Advanced tutorials]]+
-[[Category:English documentation]]+

Current revision

article need of major revision - one with dual wan as backup another simple round equalization

This tutorial explains how you can assign one (or more) of the LAN ports as an extra WAN port. There is another tutorial Dual-WAN for simple round-robin load equalization which explains how you can load balance between the two WAN connections. In this case I did not want to load balance; but rather create a standby WAN connection.

Contents

[edit] Justification

I needed to configure backup WAN as standby as it is not an unlimited connection. I pay for the backup connections by Giga-Bytes used. My primary WAN connection is of unlimited type. I intend to switch to backup only when the primary one goes down.

[edit] Assumptions

I have assumed static IP addresses for both the WAN interfaces. Making them dynamic will require some changes (hint: nvram set wan2_proto=dynamic) Also, I am assuming DNSMasq is used for DHCP and DNS. JFFS should be enabled if you want to save the WAN-connection switch scripts. Also, I am assuming that you have already configured the first WAN connection (tied to vlan1) using nvram or web interface.

[edit] Create an extra VLAN

First you need to create an extra VLAN. In this case we want to to remove the port 4 from vlan0 and add it to the new vlan2

nvram set vlan0ports="1 2 3 5*"
nvram set vlan2ports="4 5"
nvram set vlan2hwname=et0
nvram set wan2_ifnames=vlan2
nvram set wan2_ifname=vlan2
nvram set wan2_mtu=1500
nvram commit

You can confirm or perform the setting using the dd-wrt web interface

http://your_router_ip/Vlan.asp

Now you have created an extra VLAN (vlan2).

[edit] Bring up the vlan2 interface

I found it easier to configure the interface using ifconfig in the startup script. Somehow nvram bindings for backup WAN interface IP address did not work. ifconfig does the job though.

 nvram set rc_startup='
 #!/bin/ash

 PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"

 ifconfig vlan2 10.10.2.209 netmask 255.255.255.0

 ifconfig vlan2 up
 ' 

Replace 10.10.2.209 with your WAN2 IP address

You can also perform this operation via the web interface

http://your_router_ip/Diagnostics.asp

Of course you will need a reboot for this to be effective.

[edit] Configure NAT on vlan2

We want to make sure packets leaving vlan2 are NATed

 nvram set rc_firewall='
  iptables -t nat -A POSTROUTING -o vlan2 -j MASQUERADE
 '

Again, the same Diagnostics.asp page can be used on the web interface.

[edit] Create scripts to do the connection switch

We switch the internet connection by switching the default route and DNS servers.

Here we will create two scripts in /jffs to switch from one WAN connection to the other.

[edit] Script to switch to wan1

Put this in /jffs/activate.wan1:

#!/bin/ash
nvram set wan_dns="10.10.1.10 10.10.1.11"
route delete default
route delete default
route add default gw 10.10.1.1 vlan1
echo "nameserver 10.10.1.10" > /tmp/resolv.dnsmasq
echo "nameserver 10.10.1.11" >> /tmp/resolv.dnsmasq
pr="$(ps | awk '/dnsmasq/ {print $1}')"
kill -9 $pr
dnsmasq --conf-file /tmp/dnsmasq.conf

Used kill -9; because not sure why -1 (HUP) didnt work.

Obviously 10.10.1.10 and 10.10.1.11 are DNS servers for WAN1 and 10.10.1.1 is the default gateway. Replace these values with your own settings for WAN1.

[edit] Script to switch to wan2

And put this in /jffs/activate.wan2:

#!/bin/ash
nvram set wan_dns="10.10.2.10 10.10.2.11"
route delete default
route delete default
route add default gw 10.10.2.1 vlan2
echo "nameserver 10.10.2.10" > /tmp/resolv.dnsmasq
echo "nameserver 10.10.2.11" >> /tmp/resolv.dnsmasq
pr="$(ps | grep dnsmasq | grep -v grep| awk '{print $1}')"
kill -9 $pr
dnsmasq --conf-file /tmp/dnsmasq.conf &

Obviously 10.10.2.10 and 10.10.2.11 are DNS servers for WAN2 and 10.10.2.1 is the default gateway. Replace these values with your own settings for WAN2.

You can switch connection by running the respective script.

Connect the cable

Connect the backup WAN cable to the ethernet port marked as "4" and reboot.

[edit] More to come

  1. Automation of connection switching with email notification
  2. Web interface to monitor and switch connection

[edit] See also