Dual WAN Failover doesn't failover back to WAN 1 [Resolved]
-
@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
@Raffi_ My WAN 1 - igb0, WAN2 - igb2
Is this correct?#!/bin/sh # get active gateway and current time CURRENT_TIME="$(date +"%c")" CURRENT_GW="$(netstat -rn | grep default | awk '{print $4}')" if [ $CURRENT_GW = "igb2" ]; then #check if WAN1 is up or not igb0_STATUS="$(pfSsh.php playback gatewaystatus brief | grep WANGW | awk '{print $2}')" if [ $WAN1_STATUS = "none" ]; then #WAN1 is back online, stop/start WAN2 echo "$CURRENT_TIME: Bringing down igb2" ifconfig em2 down echo "$CURRENT_TIME: Sleeping for 30s" sleep 30 echo "$CURRENT_TIME: Bringing up igb2" ifconfig em2 up else echo "$CURRENT_TIME: igb0 is still down" fi else echo "$CURRENT_TIME: Nothing to do!" fi
Close but not quite right. You missed two em2 lines. See below. I forgot to mention the WAN1 interface but it looks like you got that right.
#!/bin/sh # get active gateway and current time CURRENT_TIME="$(date +"%c")" CURRENT_GW="$(netstat -rn | grep default | awk '{print $4}')" if [ $CURRENT_GW = "igb2" ]; then #check if WAN1 is up or not igb0_STATUS="$(pfSsh.php playback gatewaystatus brief | grep WANGW | awk '{print $2}')" if [ $WAN1_STATUS = "none" ]; then #WAN1 is back online, stop/start WAN2 echo "$CURRENT_TIME: Bringing down igb2" ifconfig igb2 down echo "$CURRENT_TIME: Sleeping for 30s" sleep 30 echo "$CURRENT_TIME: Bringing up igb2" ifconfig igb2 up else echo "$CURRENT_TIME: igb0 is still down" fi else echo "$CURRENT_TIME: Nothing to do!" fi
-
Never mind, you don't have to do anything with WAN1. That was right. Put that back to the way it was as shown below.
#!/bin/sh # get active gateway and current time CURRENT_TIME="$(date +"%c")" CURRENT_GW="$(netstat -rn | grep default | awk '{print $4}')" if [ $CURRENT_GW = "igb2" ]; then #check if WAN1 is up or not WAN1_STATUS="$(pfSsh.php playback gatewaystatus brief | grep WANGW | awk '{print $2}')" if [ $WAN1_STATUS = "none" ]; then #WAN1 is back online, stop/start WAN2 echo "$CURRENT_TIME: Bringing down WAN2" ifconfig igb2 down echo "$CURRENT_TIME: Sleeping for 30s" sleep 30 echo "$CURRENT_TIME: Bringing up WAN2" ifconfig igb2 up else echo "$CURRENT_TIME: WAN1 is still down" fi else echo "$CURRENT_TIME: Nothing to do!" fi
-
@Raffi_ Are you sure? I thought any line without # I should modify WAN into my firewall interface name?
-
@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
@Raffi_ Are you sure? I thought any line without # I should modify WAN into my firewall interface name?
I edited my script above. Only where it specified em2 is what had to be changed to igb2. references to WAN1 or even WAN2 is not hard coded to an interface so you should be able to leave that.
-
@Raffi_ said in Dual WAN Failover doesn't failover back to WAN 1:
@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
@Raffi_ Are you sure? I thought any line without # I should modify WAN into my firewall interface name?
I edited my script above. Only where it specified em2 is what had to be changed to igb2. references to WAN1 or even WAN2 is not hard coded to an interface so you should be able to leave that.
It didn't switch after 10 mins
So, i after pfsesne reboot I checked in Diagnostics-Edit File and my uploaded script there is gone and failover_script.log is empty
-
@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
It didn't switch after 10 mins
I guess I was wrong on the script. Sorry, looks like mine won't work either :/
You should see WAN2 taken down and then brought back up after 30 seconds if WAN1 is running again.
Maybe you will have to adjust those variables in that case. Let me know if you get it to work. I will have to adjust mine. At least you know how to work with scripts now. I'm sure you'll get it working.@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
So, i after pfsesne reboot I checked in Diagnostics-Edit File and my uploaded script there is gone and failover_script.log is empty
I was afraid that leaving the script in /tmp/ might lose it on reboot, but I wasn't sure.
What you can do to solve that is upload it again, and then after uploading go to Diagnostic > command prompt execute the command mv /tmp/failover_script.sh /root/
That will move the file from /tmp/ to /root/. Then you will have to modify your command in the cron job for that new location, /root/failover_script.sh. -
@Raffi_ In cron under command i have "/root/failover_script.sh. >> /tmp/failover_script.log"
But in under root its "failover_script.sh.txt " Should i change cron job command to "/root/failover_script.sh.txt >> /tmp/failover_script.log"
-
@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
@Raffi_ In cron under command i have "/root/failover_script.sh. >> /tmp/failover_script.log"
But in under root its "failover_script.sh.txt " Should i change cron job command to "/root/failover_script.sh.txt >> /tmp/failover_script.log"
No, the file must be a .sh file in order to run. A .txt file will not run. That might be why it didn't work the first time. You probably want to move the log file to /root/ as well.
-
@Raffi_ I fixed everything but it doesn't work :(
-
@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
@Raffi_ I fixed everything but it doesn't work :(
I can't really test it on my end so I can't really help much beyond that.
-
@Raffi_ Oh well, i will keep digging. I got 36 pfsense boxes. I don't have time manually rebooting/killing states when stuff like this happens tp be honest. My Sonicwalls handle this pretty easily. I am not network vet, so I honestly can't grasp the concept fully why pfsense is like that.
-
@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
@Raffi_ Oh well, i will keep digging. I got 36 pfsense boxes. I don't have time manually rebooting/killing states when stuff like this happens tp be honest. My Sonicwalls handle this pretty easily. I am not network vet, so I honestly can't grasp the concept fully why pfsense is like that.
I'm sure you'll get it working. I would also suggest taking a look at the other script that was linked on a different thread mentioned above. That one was defined very well with instructions. Maybe you'll find it easier to follow/modify that one. Now that you have some understanding of how to go about it you might find that a better solution.
-
Thanks for your time and chewing everything out for me, I used cron for other things but didn't really pay attention to command option there. Now I do pretty well.
-
Hello!
You could try the gateway_plugin interface if you dont mind being a guinea pig...:)
Download https://github.com/jazzl0ver/pfSense-pkg-gatewayhook/releases/download/v0.1/pfSense-pkg-gatewayhook-0_1.txz
Use Diagnostics -> Command Prompt -> Upload File to save the pkg file to the /tmp folder on your device, then
pkg install /tmp/pfSense-pkg-gatewayhook-0_1.txz
The package code is close, but not quite.
Edit /usr/local/pkg/gatewayhook.inc
The main function is missing an assignment statement and is not calling the gateway script with any parameters. The fixed function should look like :
function gatewayhook_plugin_gateway($pluginparams) { $type = $pluginparams['type']; $name = $pluginparams['name']; $event = $pluginparams['event']; $interface = $pluginparams['interface']; $gatewayhooklock = lock("gatewayhook", LOCK_EX); syslog(LOG_NOTICE, "gatewayhook: " . GATEWAY_ALARM_CUSTOM_SCRIPT . " script started - $name $event $interface"); mwexec(GATEWAY_ALARM_CUSTOM_SCRIPT . " $name $event $interface"); unlock($gatewayhooklock); return 0; }
Edit the gateway plugin script the package created - /usr/local/etc/rc.d/rc.gateway_alarm_custom
The plugin script could look something like this :
#!/bin/sh # put what needs to be done before exit line # arg 1 should be the gateaway name gwname=${1:-gwname} # arg 2 should be gateway.up or gateway.down event=${2:-gateway.unknown} # arg 3 should be the interface ... may not be present interface=${3:-interface} if [ $gwname == "WAN0" ] && [ $event == "gateway.up" ] then # clear the states on this interface /sbin/pfctl -i igb0 -Fs fi exit 0
Basically, this is saying that when the plugin script is notified that WAN0 is UP, IGB0 should get all of its states cleared.
John
-
@serbus said in Dual WAN Failover doesn't failover back to WAN 1:
pkg install /tmp/pfSense-pkg-gatewayhook-0_1.txz
Sure, few questions when I
pkg install /tmp/pfSense-pkg-gatewayhook-0_1.txz
Shell output
Updating pfSense-core repository catalogue... pfSense-core repository is up to date. Updating pfSense repository catalogue... pfSense repository is up to date. All repositories are up to date. Checking integrity... done (0 conflicting) The following 1 package(s) will be affected (of 0 checked): New packages to be INSTALLED: pfSense-pkg-gatewayhook: 0_1 [unknown-repository] Number of packages to be installed: 1 Proceed with this action? [y/N]:
How do i activate "yes"?
Another question in script below, do i change any values to reflect my interface? For example WAN0?
#!/bin/sh # put what needs to be done before exit line # arg 1 should be the gateaway name gwname=${1:-gwname} # arg 2 should be gateway.up or gateway.down event=${2:-gateway.unknown} # arg 3 should be the interface ... may not be present interface=${3:-interface} if [ $gwname == "WAN0" ] && [ $event == "gateway.up" ] then # clear the states on this interface /sbin/pfctl -i igb0 -Fs fi exit 0
-
Hello!
You should just be able to hit "y" when it asks you to proceed.
If your failover gateway group looks like:
WAN_DHCP -> tier1 -> igb0
OPT1_DHCP -> tier2 -> igb2and WAN_DHCP is coming back online after being down...
and you want any states on OPT1_DHCP to be cleared...
the script would look like...if [ $gwname == "WAN_DHCP" ] && [ $event == "gateway.up" ] then # clear the states on this interface /sbin/pfctl -i igb2 -Fs fi
John
-
@pfrickroll said in Dual WAN Failover doesn't failover back to WAN 1:
How do i activate "yes"?
To make your life easier with more complex tasks like this, I would suggest enabling SSH under System > Advanced
Then use an SSH client to connect to pfSense such as Putty. When you login use the same admin credentials as you would when logging into the GUI. From the SSH terminal, use option 8 to get a shell prompt, then it's easier to follow instructions like the one above and providing inputs to prompts like the one you got.
-
@serbus
WAN_DHCP - igb0
OPT1_DHCP - igb1So, here what i see in Shell output, I am kind of lost where do I type Y or press it because I can't interact with shell window but only the command line below it
-
@Raffi_ Yes I was about to do that actually, makes sense
-
Hello!
The shell is the way to go.
You can also do a :
pkg install -y /tmp/pfSense-pkg-gatewayhook-0_1.txz
...from the gui. The "-y" will auto-yes the install...
John