Posted inNetwork

Configuring Multi-WAN Failover on Linux: A “Never-Down” Internet Solution with Keepalived

Network tutorial - IT technology blog
Network tutorial - IT technology blog

Why Does Your System Need Multi-WAN Failover?

Try calculating the damage if your server loses connection for 30 minutes. For a medium-sized e-commerce site, this could mean losing tens of millions in revenue. Relying on a single Internet Service Provider (ISP) is a massive risk.

By default, Linux isn’t smart enough to reroute traffic automatically when the primary connection fails. If the main gateway is congested or a cable is cut, the system simply waits. By combining ip route and Keepalived, we can create an automated mechanism. When WAN 1 fails, traffic automatically “hops” to WAN 2 within seconds.

Environment Preparation

For a real-world deployment, you’ll need a Linux server (Ubuntu 22.04 or Debian 12 are the best choices). The device should have at least 3 network interfaces: 2 for ISP connections (WAN1, WAN2) and 1 for the local network (LAN).

Install the necessary orchestration tools:

sudo apt update
sudo apt install keepalived iproute2 curl -y

Detailed System Configuration

1. Setting Up Separate Routing Tables

By default, Linux only uses one main routing table. To run Multi-WAN, we must separate the data flows for each ISP. Define two additional “lanes” in the /etc/iproute2/rt_tables file:

100 isp1
101 isp2

Pro tip: When you need to calculate IP ranges (Subnets) for interfaces, use an IP Subnet Calculator. This tool helps quickly calculate the Network range and Broadcast, avoiding manual errors that cause IP conflicts.

2. Connection Health Check Script

Don’t just rely on the physical status of the network card. Sometimes the lights are green, but you can’t access the Internet due to international routing issues at the ISP level. We need a script to perform a real-world check by pinging Google DNS.

Create the file /etc/keepalived/check_wan.sh:

#!/bin/bash
# Check WAN 1 by pinging through interface eth0
if ping -I eth0 -c 1 -W 2 8.8.8.8 > /dev/null; then
    exit 0 # Network stable
else
    exit 1 # Network failure
fi

Grant execution permissions so Keepalived can call this script:

sudo chmod +x /etc/keepalived/check_wan.sh

3. Configuring Keepalived for Gateway Orchestration

Usually, Keepalived is used for Server Clusters, but here we use it to manage Gateway status. Edit the /etc/keepalived/keepalived.conf file:

vrrp_script check_wan_status {
    script "/etc/keepalived/check_wan.sh"
    interval 2  # Check every 2 seconds
    fall 2      # Confirm failure after 2 consecutive drops
    rise 2      # Confirm OK after 2 consecutive successes
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100

    track_script {
        check_wan_status
    }

    # Triggered when WAN 1 is functioning normally
    notify_master "/sbin/ip route add default via [IP_GW_1] dev eth0 metric 10"

    # Triggered when WAN 1 fails
    notify_fault "/sbin/ip route del default via [IP_GW_1] dev eth0 metric 10"
}

Note: Replace [IP_GW_1] with the actual Gateway address provided by your ISP.

Metric Priority Mechanism (Failover Logic)

We use the Metric value to rank priority. In the main routing table, set up both connections but with different priority levels:

# WAN 1: High priority (Low metric)
sudo ip route add default via [IP_GW_1] dev eth0 metric 10

# WAN 2: Backup (High metric)
sudo ip route add default via [IP_GW_2] dev eth1 metric 20

When WAN 1 fails, Keepalived executes the notify_fault command to delete the Metric 10 route. At this point, Linux automatically switches all traffic to the Metric 20 route of WAN 2. When WAN 1 recovers, Keepalived re-inserts the old route, returning the system to its original state.

Testing and Monitoring

Restart the service to apply the configuration:

sudo systemctl restart keepalived

To test, try unplugging the WAN 1 cable or disabling the interface using sudo ip link set eth0 down. Then, monitor the system logs in real-time:

tail -f /var/log/syslog | grep Keepalived

If you see the line “Entering FAULT state”, the system has successfully activated the backup mode. The switchover usually takes only 3 to 5 seconds, causing almost no disruption to end users.

This approach provides complete control. You can customize the interval parameter to balance response speed and stability, preventing network flapping from causing the system to jump constantly between the two ISPs.

Share:
Tags: