Cisco – How to load balance two WAN connections

It would be easiest to tell squid to use http cache from both ISPs and round-robin between these HTTP caches.

But here's some stuff on source routing: http://linux-ip.net/html/adv-multi-internet.html

Use iptables -j MARK to mark the packets based on source address, then create a new routing table in /etc/iproutes/rt_tables and add a new rule ip rule add fwmark 4 table 4 priority 10000.

Actually reference you provided, describes a solution for your gateway router. What is misses, it's local lan setup. Here it goes:

• set up your NAT, on both interfaces

iptables -t nat -A POSTROUTING -o eth2 -s -j MASQUERADE

iptables -t nat -A POSTROUTING -o eth3 -s -j MASQUERADE

• make sure you've enabled forwarding (sysctl -w net.ipv4.ip_forward=1)

• check if facebook.com is alive, by pinging it, or trying http request - if it is alive, do nothing ;-) You may assume that if facebook.com is alive, your WAN link works fine. If it's down - people will call you anyway yelling the Internet is down, because facebook does not work anymore. You may write a script to do this.

• in case the connection is down - you have to do only one task: add ip rule and direct your traffic through failover WAN link. It primary wan is on again - delete the rule, and flush the cache. Like this:

ip rule add from 1.2.3.0/24 table WAN2

ip route flush cache

or restore traffic:

ip rule delete from 1.2.3.0/24 table WAN2

ip route flush cache

• Make your changes permanent. I'm not familiar with CentOS, but sysctl.conf and rc.local should be at your service.

• Why you don't have to switch default gateway on your box? According to your reference, you have already added default routes to different routing tables. It means, your box will be still available through secondary routing table. And yes, even with primary gateway dead, you will be able to reach it with secondary table, which has it's own default route.

• I'd also avoid balancing traffic through different prociders, as load balancing is based on route cache, so it may cause a lot of unidentified connectivity problems. I'd rather stick with failover.

• There's just final thing - if your wan links are private networks, you won't be able to reach your box from outside your network other way than redirecting ports or setting up vpn link. In this case, switching gateways might be required.

• For source reference check here.