Схема:
- Код: выделить все
+---------+
| |
| |--- enp0s8:192.168.90.2/24:Основной ->Провайдер:Шлюз:192.168.90.1/24
--- enp0s3:192.168.92.2/24:Офис ---| CentOS8 |
| |--- enp0s9:192.168.91.2/24:Резервный->Провайдер:Шлюз:192.168.91.1/24
| |
+---------+
2. Выполняем команды:
- Код: выделить все
nmcli connection delete enp0s3
nmcli connection add type ethernet ifname enp0s3 con-name enp0s3 ipv4.method manual ipv4.addresses 192.168.92.2/24 ipv4.dns 192.168.92.2 ipv4.route-metric 103
nmcli connection delete enp0s8
nmcli connection add type ethernet ifname enp0s8 con-name enp0s8 ipv4.method manual ipv4.addresses 192.168.90.2/24 ipv4.gateway 192.168.90.1 ipv4.dns 192.168.92.2 ipv4.routes "0.0.0.0/0 192.168.90.1 table=5000" ipv4.route-metric 101 ipv4.routing-rules "priority 5 from 192.168.90.2 table 5000"
nmcli connection delete enp0s9
nmcli connection add type ethernet ifname enp0s9 con-name enp0s9 ipv4.method manual ipv4.addresses 192.168.91.2/24 ipv4.gateway 192.168.91.1 ipv4.dns 192.168.92.2 ipv4.routes "0.0.0.0/0 192.168.91.1 table=6000" ipv4.route-metric 102 ipv4.routing-rules "priority 6 from 192.168.91.2 table 6000"
3. Проверка, выполняем команды:
- Код: выделить все
ip route
default via 192.168.90.1 dev enp0s8 proto static metric 101
default via 192.168.91.1 dev enp0s9 proto static metric 102
192.168.90.0/24 dev enp0s8 proto kernel scope link src 192.168.90.2 metric 101
192.168.91.0/24 dev enp0s9 proto kernel scope link src 192.168.91.2 metric 102
192.168.92.0/24 dev enp0s3 proto kernel scope link src 192.168.92.2 metric 103
ip rule
0: from all lookup local
5: from 192.168.90.2 lookup 5000
6: from 192.168.91.2 lookup 6000
32766: from all lookup main
32767: from all lookup default
nmap -e enp0s8 -sP --traceroute ya.ru
HOP RTT ADDRESS
1 0.39 ms 192.168.90.1
2 1.14 ms 192.168.88.1
3 1.84 ms 194.186.120.248
4 2.15 ms 195.239.76.247
5 2.52 ms 81.211.51.101
6 20.97 ms 79.104.235.207
7 29.16 ms 87.229.207.250
8 ... 9
10 26.16 ms 87.250.250.242
nmap -e enp0s9 -sP --traceroute ya.ru
HOP RTT ADDRESS
1 0.44 ms 192.168.91.1
2 1.04 ms 192.168.88.1
3 1.74 ms 194.186.120.248
4 2.19 ms 195.239.76.247
5 2.57 ms 81.211.51.101
6 21.30 ms 79.104.235.205
7 22.52 ms 87.229.207.250
8 ...
9 30.75 ms 10.3.6.1
10 26.59 ms 87.250.250.242
4. В папке /etc/systemd/system, создаём файл gateway-switch.service
- Код: выделить все
[Unit]
Description=Replace gatewey
After=network.target
[Service]
ExecStart=/opt/gateway/gateway-switch &
Type=simple
[Install]
WantedBy=default.target
5. В папке /opt/gateway, создаем файл gateway-switch
- Код: выделить все
#!/bin/bash
I_PRIMARY=enp0s8
I_RESERVE=enp0s9
G_PRIMARY=192.168.90.1
G_RESERVE=192.168.91.1
D_PRIMARY=8.8.8.8
D_RESERVE=8.8.4.4
ACTIVE=true
while [ !`sleep 10s` ];do
S_PRIMARY=`ping -I $I_PRIMARY -c 3 -W 3 $D_PRIMARY >/dev/null 2>&1 && echo 0 || echo 1`
S_RESERVE=`ping -I $I_RESERVE -c 3 -W 3 $D_RESERVE >/dev/null 2>&1 && echo 0 || echo 1`
STATUS=`echo $S_PRIMARY$S_RESERVE`
case $STATUS in
10 ) [ $ACTIVE ] && {
ip route del default via $G_RESERVE
ip route add default via $G_RESERVE dev $I_RESERVE proto static metric 100
ip route flush cache
asterisk -rx reload
#systemctl stop asterisk && sleep 2m && systemctl start asterisk
ACTIVE=""
#ip route | grep default
};;
00 ) [ $ACTIVE ] || {
ip route del default via $G_RESERVE
ip route add default via $G_RESERVE dev $I_RESERVE proto static metric 102
ip route flush cache
asterisk -rx reload
#systemctl stop asterisk && sleep 2m && systemctl start asterisk
ACTIVE=true
#ip route | grep default
};;
esac
#echo STATUS=$STATUS, ACTIVE=$ACTIVE
done
6. Выполняем команды:
- Код: выделить все
chmod 755 /opt/gateway/gateway-switch
systemctl enable gateway-switch
systemctl start gateway-switch
7. В файле /etc/sysctl.conf, добавляем строку
- Код: выделить все
net.ipv4.ip_forward = 1
Выполняем команду:
- Код: выделить все
sysctl -p
8. Настройки межсетевого экрана nftables
- Код: выделить все
table inet nftables_svc {
chain input {
type filter hook input priority filter; policy drop;
iifname "lo" accept
ip protocol icmp accept
ct state established,related accept
iifname "enp0s3" accept
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state established,related accept
ip protocol icmp accept
iifname "enp0s3" accept
}
chain output {
type filter hook output priority filter; policy accept;
}
}
table ip nftables_svc {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "enp0s8" masquerade
oifname "enp0s9" masquerade
}
}
Удачи!
