Equalized or Redundant Default Routes under Linux
Equalized or Redundant Default Routes under Linux
A Linux machine, whether it's a router, server, or workstation, can be setup to have redundant default routes, and/or use two default routes and equalize traffic across each nexthop or gateway.
Equalize Routes
Assume you have two Internet Service Providers and therefore you have two default gateways to choose from. One gateway has an IP of 10.10.10.1 and the second gateway is 10.50.50.1. You have two network cards, each connected to one ISP (via dsl, cable modem, etc). To equalize traffic across both gateways, the following command can be ran:
ip route add default equalize nexthop via 10.10.10.1 weight 1 nexthop via 10.50.50.1 weight 1
Adjusting the weight values will shift the traffic in favor of one gateway over the other. For example, if one gateway has a weight of 2 and the second has a weight of 1, the first gateway will be loaded with twice as much traffic as the second.
Redundant Default Routes
Similar to equalizing routes, setting up redundant default routes allows for using two ISPs. However, in this case, the second ISP is used for failover. In other words, if the primary ISP goes down, the second ISP will be used for Internet traffic. Assume eth0 is connected to ISP1 and has a gateway of 10.10.10.1 and eth1 is connected to ISP2 with gateway 10.50.50.1. To configure redundant default routes, the following commands can be ran:
ip route add default via 10.10.10.1 dev eth0 metric 1
ip route add default via 10.50.50.1 dev eth1 metric 10
(might also be able to use 'preference' instead of 'metric' according to the man page for 'ip')
The following parameter can be set in /etc/sysctl.conf to speficy how long ISP1 is unreachable before failover occurs:
net.ipv4.route.gc_timeout = 10
May also have to set the following in /etc/sysctl.conf:
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth1.rp_filter = 0
Once changes are made in /etc/sysctl.conf, changes can be activated immediately by running:
sysctl -p
Previous page: Enable X11 Forwarding
Next page: Intrusion Detection using IPTABLES Against SSH Brute Force Attacks
