Community discussions

 
OKNET
Member Candidate
Member Candidate
Topic Author
Posts: 237
Joined: Mon Jun 22, 2015 9:22 am

How to switch immediately after a failover ?

Fri Jun 28, 2019 12:34 pm

Usual failover without scripting:
https://wiki.mikrotik.com/wiki/Advanced ... _Scripting

Once a virtual gateway is down due to loss of internet connectivity, the second gateway is immediately available but all old tcp connections (as seen in /ip firewall connection) are still up and your device session is stuck in trying the old gateway.

A manual flush of connections causes immediately to bring back connectivity on the new active gateway (or wait for old connections to die).

How can I get this to happen automatically when failover takes place ?
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1790
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: How to switch immediately after a failover ?

Fri Jun 28, 2019 2:03 pm

The client needs to be notified that the connection is dead so it doesn't have to wait for timeout. I've something like this:
/ip firewall filter add action=reject chain=forward comment="Reject: local invalid" connection-state=invalid reject-with=icmp-network-unreachable src-address=<local ip range>
/ip firewall filter add action=drop chain=forward comment="Drop: invalid" connection-state=invalid
 
OKNET
Member Candidate
Member Candidate
Topic Author
Posts: 237
Joined: Mon Jun 22, 2015 9:22 am

Re: How to switch immediately after a failover ?

Fri Jun 28, 2019 3:48 pm

Actually, it seems to have not a great effect....
In which position should I place it among forward chain rules ?

Rather than notify client, shouldn't be more effective to cut out dead connections ?
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1790
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: How to switch immediately after a failover ?

Fri Jun 28, 2019 5:17 pm

I have these after "est-rel accept" rule in my "established-related" chain, which is one of the first one invoked.
Rather than notify client, shouldn't be more effective to cut out dead connections ?
Not necessaries: if client assumes connection is still good, it will send packets using that's state. BUT router will use other ISP with different external ip, which the target server won't have knowledge off and will reject.
 
anav
Forum Guru
Forum Guru
Posts: 3094
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: How to switch immediately after a failover ?

Sat Jun 29, 2019 4:38 pm

I can see this happen on my browser when I switch from vpn to non-vpn scenario. Causes confusion LOL.
So Sebastia, this seems to be a safe and useful rule to have in place in general (like part of a default). Is there any danger or potential security risk to this rule??
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
stoser
Member Candidate
Member Candidate
Posts: 107
Joined: Sun Aug 21, 2016 12:04 am

Re: How to switch immediately after a failover ?

Mon Jul 01, 2019 4:09 am

Take a look at this topic, perhaps it will help:

viewtopic.php?f=2&t=139750&hilit=connection

Specifically. if you are using srcnat for outgoing traffic, only use srcnat=masquerade. When you use masquerade, the router will automatically clear the connections for you during a recursive routing failover. Do not use srcnat=scr-nat. Hope this helps, Kind regards
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1790
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: How to switch immediately after a failover ?

Mon Jul 01, 2019 3:40 pm

Hey @anav

The rule
/ip firewall filter add action=drop chain=forward comment="Drop: invalid" connection-state=invalid
is part of the default configuration already.

The extra line with rejects local packets only is to inform local client of different network configuration. The src-address criterium is based on packet data, and that can be spoofed. A safer option would be to filter on incoming interface (or in-interface-list), but if RP-filter is enabled (https://wiki.mikrotik.com/wiki/Manual:IP/Settings) that's already verified.

So if RP-fitler=strict is set, it should be fine.
 
anav
Forum Guru
Forum Guru
Posts: 3094
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: How to switch immediately after a failover ?

Tue Jul 02, 2019 4:12 pm

I think I have RP filter loose, because my router has no morals LOL. Seriously its set to loose for some reason but heck i cant remember LOL.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)

Who is online

Users browsing this forum: No registered users and 26 guests