failover script for two internet links

Details: Category: Linux && Unix Services; Written by Mahdi Bahmani Ciahmard; Hits: 52

gbgcache:~# cat /usr/local/bin/sh.iptables
#!/bin/bash
#file sh.iptables
################################################################
##============================================================##
##------------------------------------------------------------##
## Here it is...part of bahmani's Firewall. ##
## Nat Users SHABAKIEH List...77.237.186.225-77.237.186.238 ##
##============================================================##
## Nat Users AZADNET List...86.109.58.225-86.109.58.238 ##
##============================================================##
##------------------------------------------------------------##
################################################################

IPTABLES="/sbin/iptables" #set to your iptables location, must be set
TCP_ALLOW="21 22 25 80 110 443 3333 6667" #TCP ports to ALLOW
UDP_ALLOW="6112 6119 4000" #UDP ports to ALLOW (53 not needed, covered by DNS above)
ARG1=$1
#INET_IFACE="ppp0" #the interface your internet's on (one only), must be set
IFACE_AZADNET="eth0" #the interface(s) your LAN's on (currently unused)
IFACE_SHABAKIEH="eth1" NET_AZADNET="86.109.58.0/24" NET_SHABAKIEH="77.237.186.0/24" SHABAKIEH="77.237.186.225-77.237.186.238" AZADNET="86.109.58.225-86.109.58.238" NAT_USERS_SHABAKIEH="/etc/squid3/nat-users-shabakieh" NAT_USERS_AZADNET="/etc/squid3/nat-users-azadnet" IP_SHABAKIEH="/etc/squid3/ip_range_shabakieh" IP_AZADNET="/etc/squid3/ip_range_azadnet" USE_SSH1="TRUE" #set to TRUE if you use "real" SSH1 (anything else is interpreted as FALSE)
USE_OPENSSH="FALSE" #set to TRUE if you use OpenSSH (anything else is interpreted as FALSE)
#INTERNAL_LAN="192.168.0.0/24 192.168.1.0/24" #the internal network(s), must be set #DENY_ALL="" #internet hosts to explicitly deny from accessing your system at all DROP="REJECT" #what to do with packets we don't want GBGVPN="192.168.5.2" VPN1="172.20.26.0/23" VPN2="172.20.28.0/23" DNS_SERVER="172.20.21.5 172.20.21.6 172.21.0.24" SQUID="/usr/sbin/squid3" USAGE="./sh.iptables [setnet] Initializing network interfaces [rpdb] Initializing Routing Policy DataBase [atos] Move Azadnet Users to shabakieh " MONSERVERS="172.20.21.38/32 172.20.21.40/32 172.20.24.24/32" SQUIDCONF="/etc/squid3/squid.conf" SED="/bin/sed" IPADDRADD="/sbin/ip addr add" IPADDRDEL="/sbin/ip addr del" IPRULEADD="/sbin/ip rule add from" IPRULEDEL="/sbin/ip rule del" ##important files ############################################################## #gbgcache:~# cat /etc/iproute2/rt_tables ## ## reserved values ## #255 local #254 main #253 default #0 unspec ## ## local ## ##1 inr.ruhep #77 uplinkshabakieh #86 uplinkazadnet #gbgcache:~# ############################################################## #gbgcache:~# cat /etc/network/interfaces # ## The loopback network interface #auto lo #iface lo inet loopback ##LAN interface Back-to-Back gbgcache <---> gbgvpn #auto eth5 #iface eth5 inet static # address 192.168.5.1 # netmask 255.255.255.252 ##Uplinkazadnet #auto eth0 #iface eth0 inet static # address 86.109.58.6 # netmask 255.255.255.0 # post-up ip route add 86.109.58.1/32 dev eth0 src 86.109.58.6 table uplinkazadnet # post-up ip route add default via 86.109.58.1 table uplinkazadnet # post-up ip rule add from 86.109.58.6 table uplinkazadnet # post-down ip rule del from 86.109.58.6 table uplinkazadnet # dns-nameservers 4.2.2.4 172.20.21.5 172.20.21.6 # dns-search gbgnetwork.net # ##uplinkshabakieh #auto eth1 #iface eth1 inet static # address # netmask 255.255.255.0 # post-up ip route add 77.237.186.1/32 dev eth2 src 77.237.186.6 table uplinkshabakieh # post-up ip route add default via 77.237.186.1 table uplinkshabakieh # post-up ip rule add from 77.237.186.6 table uplinkshabakieh # post-down ip rule del from 77.237.186.6 table uplinkshabakieh # dns-nameservers 4.2.2.4 172.20.21.5 172.20.21.6 # dns-search gbgnetwork.net # #gbgcache:~# ############################################################## #-------------------Functions---------------------------------- Flush_everything() { echo -n "Flush: " ${IPTABLES} -t filter -F INPUT echo -n "INPUT " ${IPTABLES} -t filter -F OUTPUT echo -n "OUTPUT1 " ${IPTABLES} -t filter -F FORWARD echo -n "FORWARD " ${IPTABLES} -t nat -F PREROUTING echo -n "PREROUTING1 " ${IPTABLES} -t nat -F OUTPUT echo -n "OUTPUT2 " ${IPTABLES} -t nat -F POSTROUTING echo -n "POSTROUTING " ${IPTABLES} -t mangle -F PREROUTING echo -n "PREROUTING2 " ${IPTABLES} -t mangle -F OUTPUT echo -n "OUTPUT3" echo } ##------------------------------------------------------------## ################################################################ Turn_on_IP_forwarding() { echo -n "Checking IP Forwarding..." if [ -e /proc/sys/net/ipv4/ip_forward ] ; then echo 1 > /proc/sys/net/ipv4/ip_forward echo "enabled." else echo "support not found! This will probably cause problems!" fi } ##------------------------------------------------------------## ################################################################ Enable_TCP_Syncookies() { echo -n "Checking IP SynCookies..." if [ -e /proc/sys/net/ipv4/tcp_syncookies ] ; then echo 1 > /proc/sys/net/ipv4/tcp_syncookies echo "enabled." else echo "support not found, but that's OK." fi } ##------------------------------------------------------------## ################################################################ NAT_Users() { #NAT_Users_Azadnet echo "" echo "Initializing NAT User's Azadnet..." for natip in `cat $NAT_USERS_AZADNET |grep -v ^# |grep -v ^$`;do echo "IP:"$natip echo "${IPTABLES} -t nat -A POSTROUTING -s $natip -j SNAT --to-source $AZADNET " ${IPTABLES} -t nat -A POSTROUTING -s $natip -j SNAT --to-source $AZADNET done #NAT_Users_Shabakieh echo "" echo "Initializing NAT User's Shabakieh..." for natip in `cat $NAT_USERS_SHABAKIEH |grep -v ^# |grep -v ^$`;do echo "IP:"$natip echo "${IPTABLES} -t nat -A POSTROUTING -s $natip -j SNAT --to-source $SHABAKIEH" ${IPTABLES} -t nat -A POSTROUTING -s $natip -j SNAT --to-source $SHABAKIEH done ${IPTABLES} -t nat -A POSTROUTING -s 172.20.24.31 -j SNAT --to-source $SHABAKIEH } ##------------------------------------------------------------## ################################################################ NAT_All_Users_to_Shabakieh() { #NAT_Users_Azadnet echo "" echo "Initializing NAT User's Azadnet..." for natip in `cat $NAT_USERS_AZADNET |grep -v ^# |grep -v ^$`;do echo "IP:"$natip echo "${IPTABLES} -t nat -A POSTROUTING -s $natip -j SNAT --to-source $SHABAKIEH" ${IPTABLES} -t nat -A POSTROUTING -s $natip -j SNAT --to-source $SHABAKIEH done #NAT_Users_Shabakieh echo "" echo "Initializing NAT User's Shabakieh..." for natip in `cat $NAT_USERS_SHABAKIEH |grep -v ^# |grep -v ^$`;do echo "IP:"$natip echo "${IPTABLES} -t nat -A POSTROUTING -s $natip -j SNAT --to-source $SHABAKIEH" ${IPTABLES} -t nat -A POSTROUTING -s $natip -j SNAT --to-source $SHABAKIEH done } ##------------------------------------------------------------## ################################################################ Open_DNS_Port() { for ip in $DNS_SERVER do ${IPTABLES} -A FORWARD -m udp -p udp -s $ip --dport 53 -j ACCEPT ${IPTABLES} -A FORWARD -m udp -p udp -d $ip --sport 53 -j ACCEPT done for ip in $DNS_SERVER do ${IPTABLES} -A FORWARD -s $ip -j DROP done } ##------------------------------------------------------------## ################################################################ DDOS_Prevent() { #######icmp Attacks ${IPTABLES} -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 10/s -j ACCEPT ${IPTABLES} -A FORWARD -p icmp --icmp-type echo-request -j DROP # # ########SYN floodingas ${IPTABLES} -t nat -A INPUT -p tcp --syn -m limit --limit 10/s -j ACCEPT ${IPTABLES} -t nat -A INPUT -p tcp --syn -j DROP ########SSH ssh############## ${IPTABLES} -A INPUT -s 172.20.24.31 -p tcp -m tcp --dport 22 -j ACCEPT ${IPTABLES} -A INPUT -s 192.168.5.1 -p tcp -m tcp --dport 22 -j ACCEPT ${IPTABLES} -A INPUT -s 192.168.5.2 -p tcp -m tcp --dport 22 -j ACCEPT ${IPTABLES} -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT # ${IPTABLES} -A INPUT -p tcp -m tcp --dport 22 -j DROP } ##------------------------------------------------------------## ################################################################ Normal_Run() { echo "Loading iptables firewall:" Turn_on_IP_forwarding Enable_TCP_Syncookies Flush_everything echo "Initializing VPN... " ${IPTABLES} -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 ${IPTABLES} -t nat -A PREROUTING -p udp -m udp --dport 1812 -j DNAT --to-destination $GBGVPN:1812 ${IPTABLES} -t nat -A PREROUTING -p udp -m udp --dport 1813 -j DNAT --to-destination $GBGVPN:1813 ${IPTABLES} -t nat -A POSTROUTING -s $VPN2 -j SNAT --to-source $SHABAKIEH ${IPTABLES} -t nat -A POSTROUTING -s $VPN1 -j SNAT --to-source $AZADNET #Allow outgoing https/secure web service traffic to port 443 ${IPTABLES} -A INPUT -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT ${IPTABLES} -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT Open_DNS_Port DDOS_Prevent NAT_Users ########### monitoring servers ################## #for i in $MONSERVERS #do #${IPTABLES} -A FORWARD -p icmp -s $i -j ACCEPT #${IPTABLES} -A FORWARD -p icmp -s 172.20.24.24/32 -j ACCEPT #${IPTABLES} -A FORWARD -s $i -j DROP #${IPTABLES} -A FORWARD -s 172.20.24.24/32 -j DROP #done ${IPTABLES} -t nat -A POSTROUTING -s 172.20.21.38/32 -d 4.2.2.4/32 -p ICMP -j SNAT --to-source $SHABAKIEH ${IPTABLES} -t nat -A POSTROUTING -s 172.20.21.38/32 -d 8.8.8.8/32 -p ICMP -j SNAT --to-source $SHABAKIEH ${IPTABLES} -t nat -A POSTROUTING -s 172.20.21.38/32 -p ICMP -j SNAT --to-source $AZADNET ########## hod #################### ${IPTABLES} -t nat -A POSTROUTING -s 172.20.0.0/15 -d 211.8.118.144/32 -j SNAT --to-source 86.109.58.6 ##############end hod############# ##############kia################# ${IPTABLES} -t nat -A POSTROUTING -s 172.20.0.0/15 -d 194.50.160.180/32 -j SNAT --to-source 86.109.58.6 ##############end kia############ echo "$SQUID -k reconfigure" $SED -i '/vpn1/ s/77.237.186.6/86.109.58.6/' $SQUIDCONF $SED -i '/nat_list_azadnet/ s/77.237.186.6/86.109.58.6/' $SQUIDCONF $SQUID -k reconfigure ip link set up $IFACE_AZADNET ip route del default #ip route add default scope global nexthop via 86.109.58.1 dev eth0 weight 1 nexthop via 77.237.186.1 dev eth1 weight 1 ip route add default scope global nexthop via 77.237.186.1 dev eth1 weight 1 nexthop via 86.109.58.1 dev eth0 weight 1 ip route flush cache ip route flush cache ip route flush cache } ##------------------------------------------------------------## ################################################################ Run_if_Azadnet_Down() { echo "Loading iptables firewall:" Turn_on_IP_forwarding Enable_TCP_Syncookies Flush_everything echo "Initializing VPN... " ${IPTABLES} -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 ${IPTABLES} -t nat -A PREROUTING -p udp -m udp --dport 1812 -j DNAT --to-destination $GBGVPN:1812 ${IPTABLES} -t nat -A PREROUTING -p udp -m udp --dport 1813 -j DNAT --to-destination $GBGVPN:1813 ${IPTABLES} -t nat -A POSTROUTING -s $VPN2 -j SNAT --to-source $SHABAKIEH ${IPTABLES} -t nat -A POSTROUTING -s $VPN1 -j SNAT --to-source $SHABAKIEH #Allow outgoing https/secure web service traffic to port 443 ${IPTABLES} -A INPUT -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT ${IPTABLES} -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT Open_DNS_Port DDOS_Prevent NAT_All_Users_to_Shabakieh ########### smon ################## for i in $MONSERVERS do ${IPTABLES} -A FORWARD -p icmp -s $i -j ACCEPT #${IPTABLES} -A FORWARD -p icmp -s 172.20.24.24/32 -j ACCEPT ${IPTABLES} -A FORWARD -s $i -j DROP #${IPTABLES} -A FORWARD -s 172.20.24.24/32 -j DROP done #${IPTABLES} -A FORWARD -p icmp -s 172.20.21.38/32 -j ACCEPT #${IPTABLES} -A FORWARD -p icmp -s 172.20.24.24/32 -j ACCEPT #${IPTABLES} -A FORWARD -s 172.20.21.38/32 -j DROP #${IPTABLES} -A FORWARD -s 172.20.24.24/32 -j DROP ########## hod #################### ${IPTABLES} -A FORWARD -s 172.20.0.0/15 -d 211.8.118.144/32 -j ACCEPT ${IPTABLES} -A FORWARD -s 211.8.118.144/32 -d 172.20.0.0/15 -j ACCEPT ${IPTABLES} -t nat -A POSTROUTING -s 172.20.0.0/15 -d 211.8.118.144/32 -j SNAT --to-source 211.8.118.144 ${IPTABLES} -t nat -A PREROUTING -d 211.8.118.144/32 -s 172.20.0.0/15 -j ACCEPT #########change SQUID############# echo "$SQUID -k reconfigure" $SED -i '/vpn1/ s/86.109.58.6/77.237.186.6/' $SQUIDCONF $SED -i '/nat_list_azadnet/ s/86.109.58.6/77.237.186.6/' $SQUIDCONF $SQUID -k reconfigure ip link set down $IFACE_AZADNET ip route del default ip route del default ip route add default scope global nexthop via 77.237.186.1 dev eth1 weight 1 #nexthop via 86.109.58.1 dev eth0 weight 1 ip route flush cache ip route flush cache ip route flush cache ##------------------------------------------------------------## ################################################################ } ##------------------------------------------------------------## ################################################################ Clear_RPDB() { ip route flush cache ip rul flush #for i in `cat $IP_SHABAKIEH` # do # $IPADDRDEL $i dev $IFACE_SHABAKIEH # $IPRULEDEL $i table uplinkshabakieh #done #for i in `cat $IP_AZADNET` # do # $IPADDRDEL $i dev $IFACE_AZADNET # $IPRULEDEL $i table uplinkazadnet #done #for i in `cat $NAT_USERS_AZADENET` # do # $IPRULEDEL nat 86.109.58.6 from $i #done #for i in `cat $NAT_USERS_SHABAKIEH` # do # $IPRULEDEL nat 77.237.186.6 from $i # done # ip route del $NET_AZADNET dev $IFACE_AZADNET src 86.109.58.6 table uplinkazadnet # ip route del default via 86.109.58.1 table uplinkazadnet # ip route del $NET_SHABAKIEH dev $IFACE_SHABAKIEH src 77.237.186.6 table uplinkshabakieh # ip route del default via 77.237.186.1 table uplinkshabakieh # ip route del $NET_AZADNET dev $IFACE_AZADNET src 86.109.58.6 # ip route del $NET_SHABAKIEH dev $IFACE_SHABAKIEH src 77.237.186.6 # ip route del default scope global nexthop via 86.109.58.1 dev $IFACE_AZADNET weight 1 nexthop via 77.237.186.1 dev $IFACE_SHABAKIEH weight 1 } Initializing_NET_IFS() { ##ifconfig eth4 172.20.21.12 netmask 255.255.255.128 up #ifconfig $IFACE_AZADNET 86.109.58.6 netmask 255.255.255.0 up #ifconfig $IFACE_SHABAKIEH 77.237.186.6 netmask 255.255.255.0 up #ifconfig eth5 192.168.5.1 netmask 255.255.255.252 up #ip link set down eth4 ip route flush cache ip link set up eth5 ip link set up eth0 ip link set up eth1 #ifup -a ip route add default scope global nexthop via 86.109.58.1 dev eth0 weight 1 nexthop via 77.237.186.1 dev eth1 weight 1 #################Route For VPN Pools route add -net 172.20.26.0/23 gw GBGVPN route add -net 172.20.28.0/23 gw GBGVPN route add -net 172.20.0.0/15 gw GBGVPN ip route flush cache } Initializing_RPDB() { for i in `cat $IP_SHABAKIEH |grep -v ^# |grep -v ^$` do $IPADDRADD $i dev $IFACE_SHABAKIEH $IPRULEADD $i table uplinkshabakieh done for i in `cat $IP_AZADNET |grep -v ^# |grep -v ^$` do $IPADDRADD $i dev $IFACE_AZADNET $IPRULEADD $i table uplinkazadnet done #for i in `cat $NAT_USERS_AZADENET |grep -v ^# |grep -v ^$` # do # $IPRULEADD nat 86.109.58.6 from $i # done #for i in `cat $NAT_USERS_SHABAKIEH |grep -v ^# |grep -v ^$` # do # $IPRULEADD nat 77.237.186.6 from $i # done # ip route add $NET_AZADNET dev $IFACE_AZADNET src 86.109.58.6 table uplinkazadnet # ip route add default via 86.109.58.1 table uplinkazadnet # ip route add $NET_SHABAKIEH dev $IFACE_SHABAKIEH src 77.237.186.6 table uplinkshabakieh # ip route add default via 77.237.186.1 table uplinkshabakieh # ip route add $NET_AZADNET dev $IFACE_AZADNET src 86.109.58.6 # ip route add $NET_SHABAKIEH dev $IFACE_SHABAKIEH src 77.237.186.6 # ip route add default scope global nexthop via 86.109.58.1 dev $IFACE_AZADNET weight 1 nexthop via 77.237.186.1 dev $IFACE_SHABAKIEH weight 1 } ##------------------------------------------------------------## ################################################################ #ghl # Main if [ "$#" == "0" ];then
echo ""
echo "**********************************************"
Normal_Run
echo ""
echo "**********************************************"

fi

if [ "$ARG1" = '-h' ]; then
echo ""
echo "**********************************************"
echo "$USAGE"
#lear_Variables
echo ""
echo "**********************************************"
exit 1
fi

if [ "$ARG1" = '--help' ]; then
echo ""
echo "**********************************************"
echo "$USAGE"
#lear_Variables
echo ""
echo "**********************************************"
exit 1
fi

if [ "$ARG1" = '?' ]; then
echo ""
echo "**********************************************"
echo "$USAGE"
#lear_Variables
echo ""
echo "**********************************************"
exit 1
fi

if [ "$#" == "1" ];then
if [ "$ARG1" == "atos" ];then
echo ""
echo "**********************************************"
echo "Nat All Users to Shabakieh...:)"
Run_if_Azadnet_Down
echo ""
echo "**********************************************"
fi
fi

if [ "$#" == "1" ];then
if [ "$ARG1" == "rpdb" ];then
echo ""
echo "**********************************************"
echo "Initializing_RPDB..."
#Clear_RPDB
Initializing_RPDB
echo ""
echo "**********************************************"
fi
fi

if [ "$#" == "1" ];then
if [ "$ARG1" == "setnet" ];then
echo ""
echo "**********************************************"
echo "Initializing_NET_IFS..."
Initializing_NET_IFS
echo ""
echo "**********************************************"
fi
fi

gbgcache:~#
gbgcache:~#
gbgcache:~#

Nav view search

Navigation

Search

failover script for two internet links