Automatic IP switching when internet connection is lost.


Recommended Posts

Hi All.

We are looking at setting up a system where if our main connection to the internet is lost, router fails, line faults etc then our network would automatically switch to a second backup line. The data it would need to change is the gateway and DNS servers as all PWAN traffic uses internal IP addresses to access company websites (intranet, accounts and management tools). If we switched over to the backup line then we would like it to use the public IP address.

What I am looking for is something like this.

Normal details

IP range 192.168.11.0

Gateway 192..168.11.250

DNS 192.168.11.1

In the event that an internet connection is not available

Switch too

Gateway 192.168.11.254

DNS 192.168.11.10

If there is an automatic solution that uses a trigger of some sort then perfect as I would prefer it to not need an administrators input (we do sometimes need to travel to other sites plus one of our offices works shifts) but at this time I am open to all suggestions.

You would not switch the clients, you would just run HA routers with multiple wan connections. What routers do you use now?

So if running say pfsense, this is how you would do it

http://doc.pfsense.o...ancy_%28CARP%29

Your not going to want to change clients to different dns and gateway -- and I don't know of a automated way of doing that if you did.. What you could do as simple manual way would be to change your dhcp scope, and then have users either renew the dhcp lease to get the new info or reboot.

But a better solution would be to setup HA on your routers so the IP never changes.. With different internet connections you now get hardware redundancy along with connection - and you could even load balance your connections across both your internet connections in this sort of setup.

edit: Curious what sort of location is this? Guessing not a Windows AD environment if your pointing directly at the routers for dns? Oh wait your dns is not your gateway IP. Why would you need to change the dns if the gateway failed?

We use the Cisco RV082 now for this, the RV016 is also an option if you have more than 2 WANs.

Not saying these are the only options, just that they work well for us in that it auto switches when in backup mode (1 is used as main and the other is backup) or balance the load over both networks automatically using only 1 if 1 goes down.

^ but I think he mentioned if the router went down as well, not just the internet connection. I was not aware that the RV line could do HA with another RV router? if so - then yeah that would be a low priced solution.

OOps, yeah, guess I missed that last part.

If you set multiple gateways in a DHCP scope would it confuse the clients or would they just use the first on the list till it's not available (sorta like DNS servers)?

We are currently using Cisco 1921 routers that are managed by the ISP. We have 2 lines that were going to be bonded but issues with one of the lines brought both down meaning in this case the router was active and the line was showing as connected but there was no activity being past on either line. We have also had a instance when another Cisco 1921 was potentially the issue but ideally we are looking for a solution that covers both line connection issues and hardware failure. We also have a second ADSL line which I would like to use as the backup and the line the server use to upload our backups to (which I currently do with a persistent route) which is managed by a Draytek 2930 router.

If I use multiple gateways wouldn't the client always use the primary until the router wasn't available regardless of line status? Also how can I switch DNS? When the users are connected via the primary line they use private IP's which are set in our DNS servers, the backup will breakout to the internet with no link to the datacentre so they would need to switch to using public IP's. I have spoken to the provider about this as I wanted to remove all manually added zones from our DNS server and just leave the AD integrated zones.

The initial requirement is to use an automated system where the switchover is taken care of with no user input, should a fault happen out of normal business hours when it is only the night people working then the time it would take us to manually switch them could cost us financially. However as a back up to the backup, I would also like a way for them to easily switch themselves over should the automated system fail.

Going to take a look at pfsense, budman. I know you have recommended it several times before.

I am fairly sure a 1921 can do HSRP.. how you would tie in your dual internet connections not sure.

But still thinking about it the wrong way.. You don't change your lan IP scope just because your internet connection changes, or the hardware to the connection fails.

You setup a ha pair with hsrp or virtual IP, lots of different terms for pretty much the same thing. You have 2 routers, and then either 1 or more internet connections on the wan side connected to these routers. You then route traffic to the connection you want, be it using 1 and other as fallback, or load balancing, etc. from the lan side nothing changes if one of the routers fail. Since the router that is currently active will hold that gateway IP your clients use.

And I still at a loss to why you should have to change your dns if your internet connection changes? Your local dns would still work, or use a non isp based external dns, etc.

  • 2 months later...
  On 15/05/2013 at 18:20, BudMan said:

I am fairly sure a 1921 can do HSRP.. how you would tie in your dual internet connections not sure.

But still thinking about it the wrong way.. You don't change your lan IP scope just because your internet connection changes, or the hardware to the connection fails.

You setup a ha pair with hsrp or virtual IP, lots of different terms for pretty much the same thing. You have 2 routers, and then either 1 or more internet connections on the wan side connected to these routers. You then route traffic to the connection you want, be it using 1 and other as fallback, or load balancing, etc. from the lan side nothing changes if one of the routers fail. Since the router that is currently active will hold that gateway IP your clients use.

And I still at a loss to why you should have to change your dns if your internet connection changes? Your local dns would still work, or use a non isp based external dns, etc.

As the norm budman is correct :) 1921s do HRSP. You require a 1921 for each net conn and you pair them for Ha/hrsp. 3 LAN IPS are required. 1 for each 1921 and one for hrsp. I have a pair of fibre 100mb converted/presented as cat6 entering the premises main conn into first 1921 and backup fibre into 2nd 1921. The hrsp IP becomes your DG and the 1921s manage failover with out any connectivity loss to clients.

^ yup! I didn't got into the internet side of it because not very clear on what exact sort of connections you have or want to use, etc. Be it a board on your 1921, be it just plain jane ethernet connected to it, etc.

We can for sure get into details if you want, its just the whole idea of changing your whole lan IP space on a loss of internet, or switch to different one makes no sense at all.

Now if you want to discuss the DNS side if more - you mention AD.. So would assume you have some AD box doing your AD dns, this should be the ONLY dns for your AD members. This server would then forward all requests it is not authoritative to some other box.. Now if your forwarding to an ISP dns, it might not allow you to use that one if your not coming from their network.. Which is why you could have both internet connections isps dns setup, or your local dns could go directly too roots for stuff it doesn't know, or it could use one of the many other public dns out there that does not care what network you come from.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • I've set since XP - Best performance in the Performance settings. 11 included. I enable only the show shadows after that, so I can see better fonts and mouse.. But hardly I can say I can see a difference today.
    • Yeah this kinda means nothing to me if it's going to be the same mess as HDMI 2.1 where it was difficult to know what features you were getting. It was way too confusing, designed to fool us into thinking we was getting something better with the higher number when a lot of the times we didn't get anything better because companies can add and remove features at will, which if that is the case for 2.2, then who cares lol.
    • Someone wrote a script to block 'brainrot' content online using an $8 smart plug by Usama Jawad Original image via Neil Chen Many people use smart plugs nowadays due to the various advantages they offer, including automation, integration with mobile software, increased home security, better energy efficiency, and compatibility with other smart products. However, a smart plug customer has gone a step further by enhancing their hardware in a way that it blocks them from viewing "brainrot" content online, or any website, for that matter. As seen in a popular thread over on Hacker News, a person known as "NWChen" has written a script that connects to the $8 Kasa Smart Wi-Fi Plug Mini and utilizes it to restrict access to websites of your choice. In essence, this plug then acts as a physical switch that you can toggle to visit certain websites. NWChen's main motivation behind this initiative was to avoid brainrot, with examples listed as X (formerly known as Twitter), Instagram, YouTube, and Reddit in their blog post. In terms of technical functionality, the smart plug connects to Wi-Fi (obviously) and hosts a physical switch that can be used to turn it on and off. NWChen's script connects to the smart plug via an API and then polls its state. If it's on, websites of your choice get restricted and you can't open them anymore, until you physically get up and turn off the plug, or remove the website from you blocklist. NWChen has recommended plugging in the hardware far away from you so there is sufficient resistance in turning off the plug. In the thread, many have praised this invention, believing that the nature of this mechanism provides enough hurdles where you'd rather just not visit the problematic websites anymore. However, some have noted that "those without self control cannot be trusted if they hold the switch". Some have also highlighted a problem where a user can simply stop the script's execution without much friction. Overall, it's a fairly interesting setup, even if it's fairly rudimentary in nature. Configuring this physical block with a Kasa smart plug is fairly easy. You can simply download the script from the laptop-brick GitHub project here, install it, get the IP address of your smart plug, and then use it when you're executing the script. You can modify the blocklist using a dedicated file present inside the GitHub project.
    • We'll probably mirror the EU rule, we've done that in many other areas, but if we don't, well we can add this as another reason why Brexit shouldn't have happened. Personally, if I started to get ads in WhatsApp, that would be a big incentive for me to want to switch to an alternative, and I doubt it will be difficult for me to get my contacts to change as well.
    • It reminds me of fossil fuels, as they try to push the price up and renewable energy continues to get better and cheaper, it's putting the squeeze on the fossil fuel industry. In this case, bringing jobs back to modern countries with higher wages would be a big incentive for corporations to remove humans from the workforce and replace them with AI and robotics, and the funny thing is about that, consumers will demand it because they want things cheaper not more expensive, also corporations will be forced to do it if they want to survive against others that go that route. At the end of the day, they didn't pick cheap labour because they wanted to do so, they did so because competition forced companies to do so, bringing jobs back to western countries would make these companies less competitive on the world stage, unless they use a lot more AI and robotics to remove a lot of humans from the workforce. With that said, bringing jobs back to more stable regions and using AI and robotics does have the benefit of reducing the risk of political trade wars and tariffs, but let's forget this idea of jobs coming back home to higher paying wages, that idea is dead in the water with the advancement of AI and robotics, and with humans, it would only end up making a lot more things more expensive.
  • Recent Achievements

    • One Month Later
      Miguel Batista earned a badge
      One Month Later
    • Dedicated
      moojay67 earned a badge
      Dedicated
    • Week One Done
      urbanmopdubai1 earned a badge
      Week One Done
    • One Month Later
      Jim Dugan earned a badge
      One Month Later
    • First Post
      Johnny Mrkvička earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      654
    2. 2
      Michael Scrip
      230
    3. 3
      ATLien_0
      220
    4. 4
      Steven P.
      151
    5. 5
      Xenon
      145
  • Tell a friend

    Love Neowin? Tell a friend!