Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a firewall system that is served by two uplinks to different ISPs. I'm using shorewall to manage the firewall; it load-balances traffic over both interfaces with connection tracking. All that works nicely.

I brewed some scripts to bring interfaces up/down when it detects that one of them is no longer usable. I didn't like the LSM that shorewall proposes (it's not in Ubuntu) and instead opted for netplugd for interface monitoring and a ping script in cron for connectivity testing.

The ping script basically does a single ping -I eth[01] 8.8.8.8. If the ping fails it tries again and if that fails it tells shorewall to take down the interface.

My problem happens when the firewall took the interface out of commission, then I can no longer do the ping. It always responds with Destination Host Unreachable except for pinging the immediate gateway.

Is there a way to test real internet connectivity over an interface without sending regular traffic over it?

Here are the scripts I wrote:

check_interfaces: (runs from cron and on netplugd events)

#!/bin/bash
#
# Verify state of interfaces
#
google_ping() {
        if ! ping -I "$1" -n -c1 -w1 -q 8.8.8.8 >/dev/null 2>&1; then
                # Try harder
                ping -I "$1" -n -c2 -w5 -q 8.8.8.8 >/dev/null 2>&1
        fi
}

REFRESH=
for i in eth0 eth1; do
        if google_ping $i; then
                if ! [ -e /tmp/shorewall-$i.up ]; then
                        echo Interface $i came up
                        touch /tmp/shorewall-$i.up
                        REFRESH=true
                fi
        else
                if [ -e /tmp/shorewall-$i.up ]; then
                        echo Interface $i went down
                        rm /tmp/shorewall-$i.up
                        REFRESH=true
                fi
        fi
done
if [ -n "$REFRESH" ]; then
        echo Kicking shorewall...
        /sbin/shorewall refresh >/dev/null
fi

(I know that shorewall allows you to bring down an interface with /var/lib/shorewall/firewall disable eth1 but I experienced some instability with that so I'm just using refresh)

/etc/shorewall/isusable:

# Used by shorewall to check if interface is usable
# This is sourced instead of executed so don't exit but return

# Interface is up
if [ -e "/tmp/shorewall-$1.up" ]; then
        return 0
elif ls /tmp/shorewall-*.up >/dev/null 2>&1; then
        return 1
else
        # No interfaces are up - pretend they're up and hope for the best
        return 0
fi
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.