Better Failover

netbits · Fri Oct 05, 2012 12:23 am

I have set up my Mikrotik to bond and load balance two ADSL connection using the following configuration:

/ip firewall mangle
add chain=input in-interface=WAN1 action=mark-connection new-connection-mark=WAN1_conn
add chain=input in-interface=WAN2 action=mark-connection new-connection-mark=WAN2_conn
add chain=output connection-mark=WAN1_conn action=mark-routing new-routing-mark=to_WAN1
add chain=output connection-mark=WAN2_conn action=mark-routing new-routing-mark=to_WAN2
add chain=prerouting dst-address=10.1.1.0/24 action=accept in-interface=Local
add chain=prerouting dst-address=10.2.2.0/24 action=accept in-interface=Local
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:2/0 action=mark-connection new-connection-mark=WAN1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=Local per-connection-classifier=both-addresses-and-ports:2/1 action=mark-connection new-connection-mark=WAN2_conn passthrough=yes
add chain=prerouting connection-mark=WAN1_conn in-interface=Local action=mark-routing new-routing-mark=to_WAN1
add chain=prerouting connection-mark=WAN2_conn in-interface=Local action=mark-routing new-routing-mark=to_WAN2

/ip route
add dst-address=0.0.0.0/0 gateway=10.1.1.1 routing-mark=to_WAN1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.2.2.1 routing-mark=to_WAN2 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.1.1.1 distance=1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=10.2.2.1 distance=2 check-gateway=ping

/ip firewall nat
add chain=srcnat out-interface=WAN1 action=masquerade
add chain=srcnat out-interface=WAN2 action=masquerade

I just want to check if its possible to create a better check for failover. Currently the failover is just checking to see if the ADSL router is up or not. But what happens if the line goes down or there is a problem with the ISP? Is there some way check if the internet connection rather than just checking the gateway (ADSL Router).

riggerman · Fri Oct 05, 2012 12:55 am

Hi

Simplest method is to define 2 static host routes; one via each ISP. Lets say a dns server of each of the ISPs. With those static routes in place you know that if you can ping a specific DNS server then that route is UP.

Now add a netwatch script for each of the DNS servers. If one of the routes goes down you can execute a script to disable that specific default route/connection marking firewall rule. The moment that DNS server becomes pingable again the script could re-add the load balanced default.

This give you a very nice failover option and makes it relatively bullet-proof.

Hope this helps.

cbrown · Fri Oct 05, 2012 2:57 am

You need to go past each ISPs DNS, something outside of the ISPs network. What if your ISPs backbone goes down? I have a config for this. I will try to remember to post it in the morning.

netbits · Fri Oct 05, 2012 11:30 am

Thanks. I'm pretty unfamiliar with the scripting part. But Ill google to see if I can find something.

deejayq · Sun Oct 21, 2012 9:35 pm

http://wiki.mikrotik.com/wiki/Advanced_ ... _Scripting
this is simple and in my opinion better.

Better Failover

Better Failover

Re: Better Failover

Better Failover

Re: Better Failover

Re: Better Failover

Who is online