Traffic splitting su due linee - Revision history

Gabriele.vivinetto: /* Gestione con boot startup script */

2015-02-04T11:30:48Z

Gestione con boot startup script

← Older revision		Revision as of 11:30, 4 February 2015
Line 186:		Line 186:
	* Creare il file con le funzioni start e stop:		* Creare il file con le funzioni start e stop:
	<pre>		<pre>
	cat \| sudo tee /etc/iproute2/iproute2.sh > /dev/null << 'EOFile''		cat \| sudo tee /etc/iproute2/iproute2.sh > /dev/null << 'EOFile'
	#!/bin/bash		#!/bin/bash
	set +e		set +e
Line 327:		Line 327:
	echo "Deleting multiple routes done."		echo "Deleting multiple routes done."
	}		}
			EOFile
	</pre>		</pre>

Gabriele.vivinetto: /* Riferimenti */

2010-12-10T12:26:07Z

Riferimenti

← Older revision		Revision as of 12:26, 10 December 2010
Line 480:		Line 480:

	==Riferimenti==		==Riferimenti==
	*[http://en.~~traffpro~~.ru/~~index~~.~~php?option=com_kunena&Itemid=54&func=view&catid=50&id=28~~ Routing multiple ~~isps, failover isp - Traffpro~~]		*[https://kindlund.wordpress.com/2007/11/19/configuring-multiple-default-routes-in-linux/ Configuring Multiple Default Routes in Linux « Darien Kindlund’s Blog]
			*[http://www.betacrew.org/public/post/failover-con-2-isp-via-iproute2-45.asp Failover con 2 ISP via IPROUTE2 - Italian Beta Crew sito ufficiale]
			*http://www.i-synapse.it/products/opensource/izbalancing/download/izbalancing
			*[http://lwn.net/Articles/145406/ IDS Load Balancing HOWTO [LWN.net]]
			*[http://www.policyrouting.org/iproute2.doc.html IPROUTE2 Utility Suite Documentation]
			*[http://www.policyrouting.org/iproute2.doc.html IPROUTE2 Utility Suite Documentation]
			*[http://mailman.ds9a.nl/pipermail/lartc/2002q1/002667.html LARTC More things about /proc / failover of default gateway]
			*[http://lartc.org/howto/lartc.rpdb.multiple-links.html LARTC: 4.2. Routing for multiple uplinks/providers]
	*[http://home.regit.org/?page_id=20 Links Load balancing « To Linux and beyond !]		*[http://home.regit.org/?page_id=20 Links Load balancing « To Linux and beyond !]
	*[http://lartc.org/howto/lartc.rpdb.multiple-links.html LARTC: 4.2. Routing for multiple uplinks/providers]
	*[http://openskill.info/topic.php?ID=124 Linux firewalling: Introduzione a Iptables]		*[http://openskill.info/topic.php?ID=124 Linux firewalling: Introduzione a Iptables]
	*[http://www.~~linux-foundation~~.~~org~~/en/~~Net:Iproute2 Net:Iproute2~~ - ~~The Linux Foundation]~~		*[http://www.spinics.net/lists/linux-net/msg14194.html Linux Networking: Re: Kernel panic: Route cache, RCU, possibly FIB trie.]
	*[http://~~www.policyrouting.org/iproute2.doc~~.html ~~IPROUTE2 Utility Suite Documentation]~~
	*[http:~~//www.betacrew.org/public/post/failover-con-2-isp-via-iproute2-45.asp Failover con 2 ISP via IPROUTE2 - Italian Beta Crew sito ufficiale]~~
	*[http:~~//blog.khax.net/2009/11/28/multi-gateway-routing-with-iptables-and-iproute2/ Multi gateway routing with iptables and iproute2 « khax.net]~~
	*[http:~~//www.policyrouting.org/iproute2~~.~~doc.html IPROUTE2 Utility Suite Documentation~~]
	*[http://lkml.indiana.edu/hypermail/linux/net/0012.2/0035.html Linux-Net Archive: Re: ARP Cache Timeout question]		*[http://lkml.indiana.edu/hypermail/linux/net/0012.2/0035.html Linux-Net Archive: Re: ARP Cache Timeout question]
	*[http://www.linux.com/archive/articles/113988 Linux.com :: Using a Linux failover router]		*[http://www.linux.com/archive/articles/113988 Linux.com :: Using a Linux failover router]
	*[http://~~mailman~~.~~ds9a~~.nl/~~pipermail~~/~~lartc~~/~~2002q1~~/~~002667.html LARTC More things about~~ /~~proc / failover of default~~ gateway]		*[http://blog.khax.net/2009/11/28/multi-gateway-routing-with-iptables-and-iproute2/ Multi gateway routing with iptables and iproute2 « khax.net]
	*[~~https~~://~~kindlund~~.~~wordpress~~.~~com~~/~~2007~~/11/19/~~configuring-~~multiple-~~default-routes-in-linux/ Configuring Multiple Default Routes in Linux « Darien Kindlund’s Blog~~]		*[http://www.linux-foundation.org/en/Net:Iproute2 Net:Iproute2 - The Linux Foundation]
			*[http://en.traffpro.ru/index.php?option=com_kunena&Itemid=54&func=view&catid=50&id=28 Routing multiple isps, failover isp - Traffpro]
	*[http://www.wifi.com.ar/english/doc/network/load-balancing-failover-with-dual-multi-wan-adsl-cable-cdrouter.html Wifi.com.ar Router Firewall Balancer Software Appliance]		*[http://www.wifi.com.ar/english/doc/network/load-balancing-failover-with-dual-multi-wan-adsl-cable-cdrouter.html Wifi.com.ar Router Firewall Balancer Software Appliance]
	*[http://lwn.net/Articles/145406/ IDS Load Balancing HOWTO [LWN.net]]
	*http://www.i-synapse.it/products/opensource/izbalancing/download/izbalancing
	*[http://www.spinics.net/lists/linux-net/msg14194.html Linux Networking: Re: Kernel panic: Route cache, RCU, possibly FIB trie.]

Gabriele.vivinetto: /* Riferimenti */

2010-12-10T12:15:22Z

Riferimenti

← Older revision		Revision as of 12:15, 10 December 2010
Line 480:		Line 480:

	==Riferimenti==		==Riferimenti==
			*[http://en.traffpro.ru/index.php?option=com_kunena&Itemid=54&func=view&catid=50&id=28 Routing multiple isps, failover isp - Traffpro]
			*[http://home.regit.org/?page_id=20 Links Load balancing « To Linux and beyond !]
	*[http://lartc.org/howto/lartc.rpdb.multiple-links.html LARTC: 4.2. Routing for multiple uplinks/providers]		*[http://lartc.org/howto/lartc.rpdb.multiple-links.html LARTC: 4.2. Routing for multiple uplinks/providers]
	*[http://openskill.info/topic.php?ID=124 Linux firewalling: Introduzione a Iptables]		*[http://openskill.info/topic.php?ID=124 Linux firewalling: Introduzione a Iptables]

Gabriele.vivinetto at 12:06, 10 December 2010

2010-12-10T12:06:39Z

← Older revision		Revision as of 12:06, 10 December 2010
Line 1:		Line 1:
	Si ha un firewall collegato a due router su due linee diverse.		Si ha un firewall collegato a due router su due linee diverse.

			'''VERIFICARE IL PACCHETTO BALANCE [https://www.inlab.de/balance.html Inlab Software GmbH - Balance]'''

	Si vogliono utilizzare le due linee in ingresso ed in uscita, selezionando il tipo di traffico da instradare su una linea o sull'altra.		Si vogliono utilizzare le due linee in ingresso ed in uscita, selezionando il tipo di traffico da instradare su una linea o sull'altra.

Gabriele.vivinetto: /* Script per l'avvio automatico */

2010-12-09T17:35:59Z

Script per l'avvio automatico

@@ Line 109: / Line 109: @@
-==Script per l'avvio automatico==
+==Gestione con boot startup script==
 <pre>
@@ Line 128: / Line 133: @@
 # sudo update-rc.d iproute start 42 S . stop 33 0 . stop 33 6 .
 set +e
@@ Line 267: / Line 325: @@
          echo "Deleting multiple routes done."
+}
 </pre>
-* Installare
+* Questo è il file da modificare.
 == Instradamento di particolare traffico attraverso l'altra linea==

Gabriele.vivinetto at 17:22, 9 December 2010

2010-12-09T17:22:01Z

Show changes

Gabriele.vivinetto at 11:28, 9 December 2010

2010-12-09T11:28:01Z

← Older revision		Revision as of 11:28, 9 December 2010
Line 39:		Line 39:
	==Installazione pacchetti e verifica configurazione di base==		==Installazione pacchetti e verifica configurazione di base==

	sudo ~~apt-get~~ install iproute		sudo aptitude install iproute

	Disabilitare l'antispoof (potrebbe dare problemi in caso si usasse il nat fatto da iptables)		Disabilitare l'antispoof (potrebbe dare problemi in caso si usasse il nat fatto da iptables)

	sudoedit /etc/sysctl.conf		sudoedit /etc/sysctl.conf

	...		...
	net.ipv4.conf.default.rp_filter=0		net.ipv4.conf.default.rp_filter=0

Gabriele.vivinetto: /* Riferimenti */

2010-12-07T16:10:37Z

Riferimenti

← Older revision		Revision as of 16:10, 7 December 2010
Line 257:		Line 257:
	*[http://www.linux-foundation.org/en/Net:Iproute2 Net:Iproute2 - The Linux Foundation]		*[http://www.linux-foundation.org/en/Net:Iproute2 Net:Iproute2 - The Linux Foundation]
	*[http://www.policyrouting.org/iproute2.doc.html IPROUTE2 Utility Suite Documentation]		*[http://www.policyrouting.org/iproute2.doc.html IPROUTE2 Utility Suite Documentation]
			*[http://www.betacrew.org/public/post/failover-con-2-isp-via-iproute2-45.asp Failover con 2 ISP via IPROUTE2 - Italian Beta Crew sito ufficiale]
			*[http://blog.khax.net/2009/11/28/multi-gateway-routing-with-iptables-and-iproute2/ Multi gateway routing with iptables and iproute2 « khax.net]
			*[http://www.policyrouting.org/iproute2.doc.html IPROUTE2 Utility Suite Documentation]
			*[http://lkml.indiana.edu/hypermail/linux/net/0012.2/0035.html Linux-Net Archive: Re: ARP Cache Timeout question]
			*[http://www.linux.com/archive/articles/113988 Linux.com :: Using a Linux failover router]
			*[http://mailman.ds9a.nl/pipermail/lartc/2002q1/002667.html LARTC More things about /proc / failover of default gateway]
			*[https://kindlund.wordpress.com/2007/11/19/configuring-multiple-default-routes-in-linux/ Configuring Multiple Default Routes in Linux « Darien Kindlund’s Blog]
			*[http://www.wifi.com.ar/english/doc/network/load-balancing-failover-with-dual-multi-wan-adsl-cable-cdrouter.html Wifi.com.ar Router Firewall Balancer Software Appliance]
			*[http://lwn.net/Articles/145406/ IDS Load Balancing HOWTO [LWN.net]]
			*http://www.i-synapse.it/products/opensource/izbalancing/download/izbalancing
			*[http://www.spinics.net/lists/linux-net/msg14194.html Linux Networking: Re: Kernel panic: Route cache, RCU, possibly FIB trie.]

Gabriele.vivinetto: New page: Si ha un firewall collegato a due router su due linee diverse. Si vogliono utilizzare le due linee in ingresso ed in uscita, selezionando il tipo di traffico da instradare su una linea o ...

2008-04-29T16:38:15Z

New page: Si ha un firewall collegato a due router su due linee diverse. Si vogliono utilizzare le due linee in ingresso ed in uscita, selezionando il tipo di traffico da instradare su una linea o ...

New page

Si ha un firewall collegato a due router su due linee diverse.

Si vogliono utilizzare le due linee in ingresso ed in uscita, selezionando il tipo di traffico da instradare su una linea o sull'altra.

Schema:
<pre>

________
+----------------+ /
| | |
+-------------+ Router 1 ADSL +---|
__ | | (192.168.1.254)| /
___/ \_ +------+---------+ +----------------+ |
_/ \__ | eth1 | /
/ \ | 192.168.1.253 | /
| 192.168.0.0/24-----+ Linux router | | Internet
\_ __/ | | |
\__ __/ | eth1:1 | |
| | | 192.168.11.253 | |
\___/ +------+---------+ +----------------+ \
| | | \
+-------------+ Provider 2 VDSL+---\
| 192.168.11.254 | \
+----------------+ \___________

</pre>

Le interfacce ethernet possono essere fisicamente distinte, oppure fisicamente una sola, con due indirizzi ip (eth1 e eth1:1 vedi man interfaces)

I router fanno nat per conto loro.

Scopi:
* Default route tramite Router 2 via VDSL
* Solo traffico SMTP attraverso Router 1 via ADSL
* Consentire il traffico in entrata da entrambi i router

==Installazione pacchetti e verifica configurazione di base==

sudo apt-get install iproute

Disabilitare l'antispoof (potrebbe dare problemi in caso si usasse il nat fatto da iptables)

sudoedit /etc/sysctl.conf
...
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.all.rp_filter=0
...

sudo sysctl -p

Verificare
cat /proc/sys/net/ipv4/conf/all/rp_filter
0

Verificare lo stato dell'ip_forward:

cat /proc/sys/net/ipv4/ip_forward
1

Creare le due Tabelle di routing aggiungendo alla fine:

sudoedit /etc/iproute2/rt_tables
...
1 VDSL
2 ADSL

Assicurarsi che la default route settata in /etc/network/interfaces sia UNICA e corrisponda a Router_2

route -n
...
0.0.0.0 192.168.11.254 0.0.0.0 UG 0 0 0 eth1

== Configurazione del routing in ingresso==

Bisogna fare in modo che i pacchetti che entrano attraverso un'interfaccia, vengano rispediti indietro attraverso la stessa interfaccia.

Questo viene fatto creando due tabelle di routing diverse.

Nel caso la connessione arrivi tramite Router_1 si userà la tabella di routing chiamata ADSL:

* si utilizzerà come ip sorgente di uscita il .1.253
ip route add 0.0.0.0 dev eth1 src 192.168.1.253 table ADSL

* si utilizzerà come gateway il .1.254.
ip route add default via 192.168.1.254 table ADSL

Nel caso la connessione arrivi tramite Router_2 si userà la tabella di routing chiamata VDSL:

* si utilizzerà come ip sorgente di uscita il .11.253
ip route add 0.0.0.0 dev eth1 src 192.168.11.253 table VDSL

* si utilizzerà come gateway il .11.254.
ip route add default via 192.168.11.254 table VDSL

(nel caso di una sola interfaccia fisica ed alias, si può utilizzare sempre eth1. In caso di interfacce fisiche diverse, usare i relativi nomi.)

Ora si deve decidere in quali casi utilizzare le due tabelle di routing.

Se la connessione arriva dall'ip .1.253 (cioè dal router ADSL), usa la tabella ADSL:
ip rule add from 192.168.1.253 table ADSL

Se la connessione arriva dall'ip .11.253 (cioè dal router VDSL), usa la tabella VDSL:
ip rule add from 192.168.11.253 table VDSL

In questo modo, ci si potrà, ad esempio, connettere in ssh da fuori su entrambe le linee.

== Instradamento di particolare traffico attraverso l'altra linea==
Tutto il traffico in uscita passa normalmente dalla linea VDSL.

Tutto il traffico forwardati in uscita passa normalmente dalla linea VDSL.

Possiamo far USCIRE ad esempio il solo traffico SMTP FORWARDATO tramite la linea ADSL.

Per far questo dobbiamo prima marcare i pacchetti smtp da forwardare tramite iptables:
iptables -t mangle -A PREROUTING \
-p tcp \
-i eth0 \
--dport \
-j MARK \
--set-mark 1

Una volta marcato il traffico, dobbiamo solo inserire uan regola che selezioni questi pacchetti per applicargli la tabella di routing ADSL:

ip rule add fwmark 1 table ADSL

==Gestione con script iptables-init.d==

* Creare il file /etc/iptables-initd/routes:
<pre>
#!/bin/bash
if [ "$1" = "on" ]
then
echo "Setting up multiple routes ..."
# Be sure to disable rp_filter in /etc/sysctl.conf
# net.ipv4.conf.default.rp_filter=0
# net.ipv4.conf.all.rp_filter=0

# ---------------------------------------------------------------------
# Mark packets for forwarded smtp connections to be routed via ADSL
# Exempt VPN traffic from marking
# In any case, there is no smtp traffic to crosrv02, because postfix
# is forced to forward mail for men users via transport_map to the
# public ip fire.mendrisio.croalliance.com
# We need smtp to crosrv02 via VPN for notebook users
# ------------------------------

#$IPTABLES -t mangle -A PREROUTING \
# -p tcp \
# -i $LAN0_IF --dport 25 -d ! 192.168.10.0/24 \
# -j LOG \
# --log-level debug \
# --log-prefix "Routed via ADSL: "

$IPTABLES -t mangle -A PREROUTING \
-p tcp \
-i $LAN0_IF --dport 25 -d ! 192.168.10.0/24 \
-j MARK --set-mark 1

# This does not work, because local processes bind always to the
# default interface. Try to use the "bind" option in the software
# you use.
#$IPTABLES -t mangle -A OUTPUT \
# -p tcp \
# --dport 25 \
# -j MARK --set-mark 1

# Be sure that ADSL and VDSL tables are inside /etc/iproute2/rt_tables

# Build the VDSL routing table
# When using this table, use .11.253 as source address
ip route add 0.0.0.0 dev eth1 src 192.168.11.253 table VDSL
# When using this table, your default gw is .11.254
ip route add default via 192.168.11.254 table VDSL

# Build the ADSL routing table
# When using this table, use .1.253 as source address
ip route add 0.0.0.0 dev eth1 src 192.168.1.253 table ADSL
# When using this table, your default gw is .1.254
ip route add default via 192.168.1.254 table ADSL

# This is the unconditional default route, that has already been set
# in /etc/network/interfaces
#ip route add 0.0.0.0 dev eth1 src 192.168.11.253
#ip route add default via 192.168.11.254

# Now create the rules for selecting the roting tables to use
# If the packet is marked "1" use the ADSL routing table
ip rule add fwmark 1 table ADSL
# If the packet come from .11.253 use the VDSL routing table
ip rule add from 192.168.11.253 table VDSL
# If the packet come from .1.253 use the ADSL routing table
ip rule add from 192.168.1.253 table ADSL
# For other packets, use the default route

echo "Setting up multiple routes done."

elif [ "$1" = "off" ]
then
echo "Deleting multiple routes..."
ip route del 0.0.0.0 dev eth1 src 192.168.11.253 table VDSL
ip route del default via 192.168.11.254 table VDSL

ip route del 0.0.0.0 dev eth1 src 192.168.1.253 table ADSL
ip route del default via 192.168.1.254 table ADSL

#ip route del 0.0.0.0 dev eth1 src 192.168.1.253
#ip route del default via 192.168.1.1

ip rule del fwmark 1 table ADSL
ip rule del from 192.168.11.253 table VDSL
ip rule del from 192.168.1.253 table ADSL

# ---------------------------------------------------------------------
# Unmark packets for outgoing mail
# ------------------------------

# this is done in stop.firewall

#$IPTABLES -t mangle -D PREROUTING \
# -p tcp \
# -i $LAN0_IF --dport 25 \
# -j MARK --set-mark 1

echo "Deleting multiple routes done."

else
echo "Usage: $(basename) [on|off]"
exit 1
fi
</pre>

Inserire in start.firewall, dopo il setup delle default policies:

if [ -e /etc/iptables-initd/routes ]
then
source /etc/iptables-initd/routes on
fi

Inserire in stop.firewall, alla fine:

if [ -e /etc/iptables-initd/routes ]
then
source /etc/iptables-initd/routes off
fi
Assicurarsi che in stop.firewall siano definiti:
LAN0_IF="eth0"
WAN0_IF="eth1"

==Todo==
Trovare un modo per gestire anche il traffico generato in locale dal firewall stesso.

==Riferimenti==
*[http://lartc.org/howto/lartc.rpdb.multiple-links.html LARTC: 4.2. Routing for multiple uplinks/providers]
*[http://openskill.info/topic.php?ID=124 Linux firewalling: Introduzione a Iptables]
*[http://www.linux-foundation.org/en/Net:Iproute2 Net:Iproute2 - The Linux Foundation]
*[http://www.policyrouting.org/iproute2.doc.html IPROUTE2 Utility Suite Documentation]