Re: [LARTC] Iptables, SNAT/MASQ, Multiple gateways

[don-lartc@isis.cs3-inc.com (Don Cohen)]

Simon Matthews writes:
 > OK, this may be a reasonable approach, but how do I force it initiate 
 > connections from the "fast" interface, yet allow it to fail over to the 
 > slow interface if the sytem removes the route to the fast gateway because 
 > it has detected that it is not responding? 

Off hand I don't know anything built in for this (I look forward to
hearing an answer from someone who does), but I don't think this is 
really what you want anyway.  It's not as if your link is the only one
that could fail!
If ISP1's upstream link fails then you want to use ISP2 for all
traffic other than that intended for ISP1 itself.  And of course, 
problems further upstream prevent you from reaching certain addresses
but not others, and you don't really know which without a global view
of the routing.

I think the "right" solution involves monitoring the traffic.
There's a wide range of things you could do, the simplest being 
simply detecting that the link is not responding.  You could also
try to detect tcp retransmits, measure RTT, aggregate data to measure
how well individual connections are working, further aggregate data to
determine which addresses blocks are working well and which poorly, etc.
Then use that data to decide which of your links to use for a given
destination.

I actually sent a proposal to this list that I think provides a good
solution to the general problem: an extension to TCP (possibly even
IP) that supports multiple addresses/ports.  This would even allow you
to switch addresses in the middle of a connection.  I think what I
described before applies more to the machine on the other side of your
connection, which now would know both of your addresses.  Whenever it
does a tcp retransmit it switches the address.  It therefore tends to
stay on the one that works most reliably.  (Perhaps this algorithm
could be improved to take speed into account too.)  This discussion
points out that something similar should be done on your end: you
should switch the output interface you use when you retransmit.

Of course this is not yet implemented.  It's on my queue, but not
close to the beginning.  I'd be glad if someone out there could beat
me to it. 
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/