Re: Secondary WAN

Hi Bob,

We are fairly unique in that we have thousands of remote connections coming
from telemetry terminals all over the world via mixture of GSM, SMS,
Ethernet, VPN and Satellite among others.  These are sporadic in connecting
and will take some time to 're-home' to a new ip range.

The existing WAN consists of multiple lines but this is managed by another
router one hop on from IPCop and the new WAN is similar.  So I only really
need the multi WAN temporarily during the migration.

I did have a go at iptables briefly but am a little rusty and didn't feel
confident so I bought a second IPCop instance and have that running on the
network alongside the original IPCop instance.  Both gateways are on the
network and NATing into the various services so migration can be done over
the long-term.

Thanks for taking the time to reply.


Best,
James



On 13 April 2016 at 15:46, Bob Evans <ipcopu_list-za6GKHvPnsC+O/rFHDoEyJWNWR1az2d/Wmv/[email protected]>
wrote:

> In article
> <CALgqCCnJYhVNHDPD8T05aduU5OdrxU1eeWYNnGbkR_e2iHACOQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>,
> James Bewley <[email protected]> wrote
> >We have just had a new line fitted and we need to have both WANs active
> >during the migration to the new line.
>
> Why? The question is not intended in a flippant way but because I know
> that if one is on-site and are organised, it is possible to reconfigure
> a working IPCop for a different WAN connection and/or address subnet and
> bring things back up in just a few seconds.
>
> I don't know your application of course but, if you can't accept a
> service interruption of say a minute or two outside of main business
> hours, then IPCop is probably not the appropriate tool.  And if
> continuous operation is so vitally necessary, why is there only one WAN
> circuit at present?
>
> >The new WAN operates on a different subnet to the other and obviously
> >has a different gateway address.
> >
> >>From the console I wasn't able to configure a secondary RED interface
> even
> >though I have a spare NIC available.
> >
> >I can add IP aliases from the WAN2 and IPCop appears to respond to pings
> >for these but the forwarding rules do not work.  I guess traffic is coming
> >in via WAN2 and outbound traffic is being routed out of WAN1.
>
> If the two WAN circuits are from the same provider, they might be
> willing to accept packets on each connection if they carry the source
> address of the other one.  If the provider is less clueful or two
> separate providers are involved then that probably will not be an
> option.
>
> A little Googling will show that there is at least one IPCop 2.x add-on
> to help you assign extra network interfaces via the web GUI.  However
> that doesn't solve your problem as the GUI does not offer any way to
> turn such an interface into an extra WAN port.
>
> >Is there anyway I can solve this with IPCop or any custom rules/routes I
> >need to add get this working?
>
> Yes it can be done. But not via the GUI and you will need to polish your
> IPTables skills :)
>
> I have done something similar with RouterBoards to bond multiple WAN
> circuits for bandwidth aggregation and automatic fail-over.  In
> principle you need to do three things: (a) mark incoming WAN packets
> according to which WAN port they arrive by, (b) selectively route / NAT
> packets according to the particular connections they relate to and the
> packet marks they carry and (c) devise some reliable means of monitoring
> the up state of each circuit so that you can automatically fail-over as
> necessary.
>
> But if this for a once and for all switch-over then I would suggest that
> the amount of work involved is likely to be out of all proportion to the
> benefit received.
>
> >Do I need a second IPCop instance?
>
> I cannot see how that would avoid a service interruption. But having a
> second pre-configured box in situ and already running would mean that
> the perceived outage would be not much more than the time needed to swap
> the cables over.
>
> One hint that might help avoid a few moments of panic immediately after
> a switch-over: When re-plugging equipment that is already in operation,
> don't forget that, even if the IP subnet address at the other end is
> unchanged, the MAC address will be different and so you still need ARP
> to do its thing!
>
> --
> Bob Evans
>
>
> ------------------------------------------------------------------------------
> Find and fix application performance issues faster with Applications
> Manager
> Applications Manager provides deep performance insights into multiple
> tiers of
> your business applications. It resolves application problems quickly and
> reduces your MTTR. Get your free trial!
> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
> _______________________________________________
> IPCop-user mailing list
> [email protected]
> Manage your subscription or unsubscribe
> https://lists.sourceforge.net/lists/listinfo/ipcop-user
>
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user