Arrange for load_balance.pl to be run on system startup time.
You may do this by adding an entry in rc.local:
if [ -x /etc/network/load_balance.pl ]; then
/etc/network/load_balance.pl
fi
Modify as needed for RedHat/CentOS.
However, my preference is to invoke the script when the LAN interface
comes up. On Ubuntu/Debian systems, edit
/etc/network/interfaces (Ubuntu/Debian), find the reference to
the LAN interface, and edit it to add a "post-up" option as shown
here:
auto eth2
iface eth2 inet static
... blah blah ...
post-up /etc/network/load_balance.pl
On RedHat/CentOS systems, create an executable script named
/sbin/ifup-local, and populate it with the following code:
#!/bin/sh
LANDEV=eth2;
if [ "$1" eq "$LANDEV" ] ; then
/etc/sysconfig/network-scripts/load_balance.pl
fi
Be sure to change "eth2" to the correct device for the LAN interface.
Further Configuration
=====================
The default is to establish a reasonably restrictive firewall which
allows incoming ssh services to the router from the Internet and
rejects all other incoming services. You may modify this if you wish
by adding additional firewall rules and routes.
The routes and rules are located in these subdirectories on
Ubuntu/Debian systems:
/etc/network/balance/firewall # firewall rules
/etc/network/balance/routes # routes
and here on RedHat/CentOS systems:
/etc/sysconfig/network-scripts/balance/firewall # firewall rules
/etc/sysconfig/network-scripts/balance/routes # routes
Any files you put into these directories will be read in alphabetic
order and added to the routes and/or firewall rules emitted by the
load balancing script.
A typical routing rules file will look like the example shown
below.
ip route add 192.168.100.1 dev eth0 src 198.162.1.14
ip route add 192.168.1.0/24 dev eth2 src 10.0.0.4
Each line will be sent to the shell, and it is intended (but not
required) that these be calls to the "ip" command. General shell
scripting constructs are not allowed here.
A typical firewall rules file will look like the example shown here:
# accept incoming telnet connections to the router
iptable -A INPUT -p tcp --syn --dport telnet -j ACCEPT
# masquerade connections to the DSL modem's control interface
iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
You may also insert routing and firewall rules via fragments of Perl
code, which is convenient because you don't have to hard-code any
network addresses and can make use of a variety of shortcuts. To do
this, simply end the file's name with .pl and make it executable.
Here's an example of a file named
balance/firewall/01.forwardings.pl that defines a series of
port forwarding rules for incoming connections:
$B->forward(80 => '192.168.10.35'); # forward port 80 to internal web server
$B->forward(443=> '192.168.10.35'); # forward port 443 to
$B->forward(23 => '192.168.10.35:22'); # forward port 23 to ssh on web sever
The main thing to know is that on entry to the script the global
variable $B will contain an initialized instance of a
Net::ISP::Balance object. You may then make method calls on this
object to emit firewall and routing rules. Please read the manual page
for Net::ISP::Balance for further information ("man
Net::ISP::Balance").
Calling the Script by Hand
==========================
You can invoke load_balance.pl from the command line to manually bring
up and down ISP services. The format is simple:
/etc/network/load_balance.pl ISP1 ISP2 ISP3 ... # Ubuntu/Debian
/etc/sysconfig/network-scripts/load_balance.pl ISP1 ISP2 ISP3 ... # RedHat/CentOS
ISP1, etc are service names defined in the configuration file. All
ISPs indicated on the command line will be maked as "up", others will
not be used for load balancing. If no services are indicated on the
command line, then ALL the ISP services will be marked up initially
and lsm will be launched to monitor their connectivity periodically.
Adding a -d option will print the routing and firewall commands to
standard output for inspection.
How it Works
============
The script uses two tricks to balance. The first is to set up a
multipath default routing destination as described at
http://lartc.org/howto/lartc.rpdb.multiple-links.html
ip route add default \
nexthop via 206.250.80.122 dev ppp0 weight 1 \
nexthop via 198.5.13.201 dev eth0 weight 1
This balances network sessions originating from the router, but does
not work for forwarded (NAT-ed) sessions from the LAN. To accomplish
the latter, the script uses a combination of ip routing tables for
outgoing connections, the firewall mark (fwmark) mechanism to select
tables, and the iptables "mangle" chain to randomly select which
ISP to use for outgoing connections:
iptables -t mangle -A PREROUTING -i eth2 -m conntrack --ctstate NEW \
-m statistic --mode random --probability 1 -j MARK-ISP1
iptables -t mangle -A PREROUTING -i eth2 -m conntrack --ctstate NEW \
-m statistic --mode random --probability 0.5 -j MARK-ISP2
This strategy is described at
https://home.regit.org/netfilter-en/links-load-balancing/.
License
=======
Perl Artistic License version 2.0
(http://www.perlfoundation.org/artistic_license_2_0).
Credits
=======
This package contains a slightly-modified version of Mika Ilmaranta's
<ilmis at nullnet.fi> Link Status Monitor (lsm) package. The original
source code can be fond at http://lsm.foobar.fi/.
Author
======
Lincoln D. Stein (lincoln.stein@gmail.com).
Senior Principal Investigator, Ontario Institute for Cancer Research