Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 12121
  • Last Modified:

IPTABLES and load balancing multiple ISPs

Hi,

We're setting up a triple homed linux box with Slackware 10.2. We're running a patched 2.6.13.5 kernel for various reasons.

eth0 = LAN
eth1 = ISP 1
eth2 = ISP 2

Both ISPs give us a static 8 IP range.

We first tried to do something like this: http://lartc.org/howto/lartc.rpdb.multiple-links.html
which sort of works but seems a bit unreliable. (bind 9.3.2 is installed locally)

As an alternative I'm now trying to get this to work: http://www.linux.com.lb/wiki/index.pl?node=Load%20Balancing%20Across%20Multiple%20Links (this is worth a read too: http://linux-ip.net/html/adv-multi-internet.html#adv-multi-internet-inbound )

Here's the problem - it requires the "random" option from netfilter iptables patch-o-matic to be installed.  

We've got iptables 1.3.5 installed but when I run the patchomatic ./runme base command it does not include "random" as a target.   Patch-o-matic version is patch-o-matic-ng-20040621.

Is anybody able to let me know how to patch the kernel and iptables to include this target?

libipt_random.c appears to be in iptables 1.3.5 but there is no libipt_random.so after compilation.

Can anybody help me figure out what's going on please?
0
wesbird
Asked:
wesbird
  • 6
  • 4
  • 2
5 Solutions
 
pablouruguayCommented:
here is the best tutorial to do that

http://tetro.net/misc/multilink.html
0
 
NopiusCommented:
pablouruguay, this tutorial is for routed, not NATed links. For NATed it doesn't fit well. This problem described here: http://linux-ip.net/html/adv-multi-internet.html#adv-multi-internet-inbound (wesbird posted it in his question :)


wesbird, I suppose you are using kernel 2.6.15?
Read here how to install 'random' module. Probably you have old version of patch-o-magic. Read here for more details: http://www.linuxjournal.com/node/7180/
http://www.netfilter.org/patch-o-matic/pom-base.html#pom-base-random

Running POM is simple; download the latest Patch-o-matic tarball from the directory /pub/patch-o-matic on ftp.netfilter.org, restore it on your system and run the following command while logged in as root. Make sure to give the correct kernel source directory name as the value of the KERNEL_DIR parameter:

KERNEL_DIR=/usr/src/linux-2.6.15 ./runme random





0
 
wesbirdAuthor Commented:
Hi again,

Am I making some silly mistake here?

did a make clean on the kernel,
tried ./runme random on the correct kernel source tree

it said that the patch was already applied
 
rebuilt the kernel and I'm still getting this:

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load match `random':/usr/lib/iptables/libipt_random.so: cannot open shared object file: No such file or directory
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
pablouruguayCommented:
reistall iptables

the library doesn't link to the system.
0
 
NopiusCommented:
0
 
NopiusCommented:
also you need correct iptables source tree before applying patch
KERNEL_DIR=/usr/src/linux/ IPTABLES_DIR=/where_is_your_iptables/ ./runme random
next rebiuld and install iptables
next rebuild and install kernel
0
 
NopiusCommented:
Today I did it on lates 2.6.16.11 kernel. Works fine.
Also there is 'nth' extention module in iptables. Use it and you may match any Nth packet, so load balancing will bee more predictable. To add it to your sorces use: ./runme nth
To read more about 'nth' man iptables or read help file for 'nth' modile in path-o-matic
After patching kernel, don't forget to run 'make menuconfig' a to toggle 'random match' and 'nth match' modules in appropriate branches.
Here is example of how random works:
[root@localhost ~]# iptables -A INPUT -m random -j REJECT
[root@localhost ~]# ping localhost
PING localhost.localdomain (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost.localdomain (127.0.0.1): icmp_seq=1 ttl=64 time=0.214 ms
From localhost.localdomain (127.0.0.1) icmp_seq=4 Destination Port Unreachable

[root@localhost ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere             random 50% reject-with icmp-port-unreachable

[root@localhost ~]# uname -a
Linux localhost.localdomain 2.6.16.11ipt #3 PREEMPT Sat Apr 29 14:13:28 VLAST 2006 i686 i686 i386 GNU/Linux


0
 
wesbirdAuthor Commented:
Hi again,

ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20060427.tar.bz2 has allowed me select it, but I've still got a couple of problems.  

iptables: Unknown error 4294967295

>> After patching kernel, don't forget to run 'make menuconfig' a to toggle 'random match' and 'nth match' modules in appropriate branches.

I've just spotted that I've still got a problem with the build.  I'm using make gconfig as opposed to menuconfig - it didn't seem to do the appropriate update.    I just found nth and random under Networking->Networking Support->Networking Options->Network Packet Filtering and they weren't checked.

Will post again tomorrow after attempting another rebuild.

0
 
NopiusCommented:
To activate 'nth' module, run:
KERNEL_DIR=/usr/src/linux/ IPTABLES_DIR=/where_is_your_iptables/ ./runme random nth
then toggle kernel parameter (doesn't matter if you are using GUI config)
then in kernel directory:

make
make install
make modules_install

then in iptables source directory:
make
make install

This error appeares either if your kernel doesn't support these modules (you didn't perform 'make install' for kernel) or if you are using incorrect parameters with this module.
0
 
wesbirdAuthor Commented:
Thanks,

We've also applied this patch for dead gateway detection which seems to improve things somewhat: http://www.ssi.bg/~ja/

0
 
wesbirdAuthor Commented:
The dead gateway detection is really cool and now the automatic failover is working too - it still takes a minute or so, but that's quicker than I can fix it at 3am - not just from disconencting eth1 or eth2, but also line failure of the DSL boxes.

Thanks for your help.

These are the values changed:

root@darkstar:/proc/sys/net/ipv4/route# ls -l
total 0
-rw-r--r--  1 root root 0 2006-05-25 16:21 error_burst
-rw-r--r--  1 root root 0 2006-05-25 16:21 error_cost
--w-------  1 root root 0 2006-05-25 16:21 flush
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_elasticity
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_interval
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_min_interval
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_min_interval_ms
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_thresh
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_timeout
-rw-r--r--  1 root root 0 2006-05-25 16:21 max_delay
-rw-r--r--  1 root root 0 2006-05-25 16:21 max_size
-rw-r--r--  1 root root 0 2006-05-25 16:21 min_adv_mss
-rw-r--r--  1 root root 0 2006-05-25 16:21 min_delay
-rw-r--r--  1 root root 0 2006-05-25 16:21 min_pmtu
-rw-r--r--  1 root root 0 2006-05-25 16:21 mtu_expires
-rw-r--r--  1 root root 0 2006-05-25 16:21 redirect_load
-rw-r--r--  1 root root 0 2006-05-25 16:21 redirect_number
-rw-r--r--  1 root root 0 2006-05-25 16:21 redirect_silence
-rw-r--r--  1 root root 0 2006-05-25 16:21 secret_interval
root@pcgate:/proc/sys/net/ipv4/route# cat *
1250
250
cat: flush: Operation not permitted
5
60
0
0
2048
0
10
32768
256
2
552
600
5
9
5120
600
root@darkstar:/proc/sys/net/ipv4/route#
0
 
NopiusCommented:
Thank you for info.
Next time instead of "ls" and "cat *", use "grep . *" it shows filenames with content.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 6
  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now