Dual WAN Failover Script

[rlj2]

Published v1.3.5, you can update using the same command I put in the OP.

v1.3.5 Notes
General:
- Renamed WAN0Monitor to WAN0 Failover Monitor
- Renamed WAN0RestoreMonitor to WAN0 Failback Monitor
- Optimized WAN Disabled Logic.
- During WAN Status Check, it will look for 0.0.0.0 as a WAN interface's Gateway or IP Address and mark it as Disconnected.
- Updated logging Verbiage for Switch WAN.
- Moved DNS Resolv File Variable to Global Variables
- Added key events to go to System Log that can be displayed in the ASUS System Log Web GUI. This includes Failures, Primary WAN switching, and Packet Loss detection.

Monitor Mode:
- Monitor Mode will now not be killed by Kill Mode or Log Clean Mode

See Screenshots for Example Logs in ASUS System Log.

Now you can start working on the web gui

 

[Ed_Lei]

Now you can start working on the web gui

X2

 

[Ranger802004]

Whenever you run into a coding issue with something that you know "it should just work" but can't quite figure out why it doesn't, don't be shy to ask for help on this forum. There are many shell script programmers here who are quite generous with their time and are willing to help out another fellow coder. Often times a second pair of eyes can help us "see through the fog" and eventually get a clearer view of the situation. You don't have to go completely solo on your coding journey.

Glad you got it working.

I’m no stranger to peer reviewing lol everything at work is peer reviewed and I 100% agree, a second set of eyes is always good.

 

[Ranger802004]

Now you can start working on the web gui

Oh boy, lol I haven’t done anything with ASP in awhile….lol

 

[rlj2]

Oh boy, lol I haven’t done anything with ASP in awhile….lol

It would be kind of nice to click a tab and see status of switchovers etc.. But I setup the email, so not a big deal. Speaking of which, i dont know what the hell was going on with verizon..
if you email phone number XXXXXXXXX@vtext.com it will text you. I did that while messing with it over the weekend. I had to finally block the text. It was sending the same text every 5 minutes for 2 days..
It wasnt my script stuff either, I had removed it through the different versions of your script.

 

[rlj2]

Whenever you run into a coding issue with something that you know "it should just work" but can't quite figure out why it doesn't, don't be shy to ask for help on this forum. There are many shell script programmers here who are quite generous with their time and are willing to help out another fellow coder. Often times a second pair of eyes can help us "see through the fog" and eventually get a clearer view of the situation. You don't have to go completely solo on your coding journey.

Glad you got it working.

I dont know how many times Ive worked on a project, and had some small thing that just wouldnt work.. no matter how many times I tried. Finally walk away awhile.. Come back.. Instantly "duh, its right there"..
Sometimes we get into tunnel vision maybe?

 

[rlj2]

Oh boy, lol I haven’t done anything with ASP in awhile….lol

Im not sure how many people actually use dualwan, but I do think this is a worthy addition to amtm since you have a install script now. maybe @thelonelycoder would consider it.

 

[amplatfus]

Hi,

Thank you for this popular thread
Thank you all for ideas and for make this dream real after long period of waiting for a fix.

In my case is working fine (v1.3.7). Only one issue: while using YazFi and while on Secondary WAN (net via USB) the devices are blocked with message: Obtaining IP address
I was wondering what should be changed. The issue was before using this script, but with message: No internet,

All the rest are working fine for the moment Still testing
Thank you for the opportunity.
amplatfus

 

[Ranger802004]

I dont know how many times Ive worked on a project, and had some small thing that just wouldnt work.. no matter how many times I tried. Finally walk away awhile.. Come back.. Instantly "duh, its right there"..
Sometimes we get into tunnel vision maybe?

Facts lol

 

[Ranger802004]

Hi,

Thank you for this popular thread
Thank you all for ideas and for make this dream real after long period of waiting for a fix.

In my case is working fine (v1.3.7). Only one issue: while using YazFi and while on Secondary WAN (net via USB) the devices are blocked with message: Obtaining IP address
I was wondering what should be changed. The issue was before using this script, but with message: No internet,

All the rest are working fine for the moment Still testing
Thank you for the opportunity.
amplatfus

Try restarting YazFi when it switches to secondary WAN and tell me the results please. It sounds like it may be related to how to the iptables rules are built and when you change WAN they break, a reload may fix it. I’m not familiar with YazFi but I imagine a restart will force it to rebuild the rules. Another thought is my script restarts firewall service for the same reason so I’m not sure if YazFi rules come back properly, does it add something to firewall start to create the iptables rules?

 

[Ranger802004]

It would be kind of nice to click a tab and see status of switchovers etc.. But I setup the email, so not a big deal. Speaking of which, i dont know what the hell was going on with verizon..
if you email phone number XXXXXXXXX@vtext.com it will text you. I did that while messing with it over the weekend. I had to finally block the text. It was sending the same text every 5 minutes for 2 days..
It wasnt my script stuff either, I had removed it through the different versions of your script.

I am going to probably incorporate the email function in a later release just need to make it universal where it will bypass if the user doesn’t set it up, which isn’t challenging just need to plan how I want to do it, probably will require a new config variable for enabled or disabled and all of the user variables for email.

 

[amplatfus]

Try restarting YazFi when it switches to secondary WAN and tell me the results please. It sounds like it may be related to how to the iptables rules are built and when you change WAN they break, a reload may fix it. I’m not familiar with YazFi but I imagine a restart will force it to rebuild the rules. Another thought is my script restarts firewall service for the same reason so I’m not sure if YazFi rules come back properly, does it add something to firewall start to create the iptables rules?

Thank you.
While on Secondary WAN, I went to the YazFi and I choose: "Apply settings".
After this I have the message: No internet on my phone.

I tried also restarting Unbound. Same result.

Best regards!

 

[Ranger802004]

Thank you.
While on Secondary WAN, I wend to the YazFi and I choose: "Apply settings".
After this I have the message: No internet on my phone.

I tried also restarting Unbound. Same result.

Best regards!

Look at your iptables rules and see if all of the rules created are still coded for wan0 interface or switched to primary wan?

 

[amplatfus]

Look at your iptables rules and see if all of the rules created are still coded for wan0 interface or switched to primary wan?

I added below the wl0.1 (YazFi network) iptables [A] On Primary WAN, On secondary WAN and [C] diff output. I do not have a clue if something here is wrong.
I would appreciate any hint

Later edit1: I guess the 5th is the one that is wrong and should change from:
YazFiREJECT all -- wl0.1 !eth0
to:
YazFiREJECT all -- wl0.1 !eth8

[A] On Primary WAN
iptables --line-numbers --list -v | grep "wl0.1"
1        4   240 YazFiREJECT  all  --  wl0.1  any     anywhere            !10.10.175.47       
1        0     0 REJECT     udp  --  wl0.1  any     anywhere             anywhere             udp dpt:ntp reject-with icmp-port-unreachable
2        0     0 REJECT     tcp  --  wl0.1  any     anywhere             anywhere             tcp dpt:ntp reject-with icmp-port-unreachable
3        0     0 ACCEPT     all  --  wl0.1  !eth0   anywhere             anywhere             state RELATED,ESTABLISHED
4        0     0 ACCEPT     all  --  !eth0  wl0.1   anywhere             anywhere           
5        0     0 YazFiREJECT  all  --  wl0.1  !eth0   anywhere             anywhere           
6      157 28864 ACCEPT     all  --  wl0.1  any     anywhere             anywhere           
1       16  1143 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             udp dpt:domain
2        0     0 ACCEPT     tcp  --  wl0.1  any     anywhere             anywhere             tcp dpt:domain
3        0     0 ACCEPT     tcp  --  wl0.1  any     anywhere             10.10.185.2         multiport dports www,https
4       54  6658 ACCEPT     all  --  wl0.1  any     anywhere             base-address.mcast.net/4
5        0     0 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             multiport dports netbios-ns,netbios-dgm
6        1   334 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             multiport dports bootps,ntp
7        0     0 ACCEPT     icmp --  wl0.1  any     anywhere             anywhere           
8        0     0 YazFiREJECT  all  --  wl0.1  any     anywhere             anywhere 

[B] On secondary WAN
iptables --line-numbers --list -v | grep "wl0.1"
1        0     0 YazFiREJECT  all  --  wl0.1  any     anywhere            !10.10.175.47       
1        0     0 REJECT     udp  --  wl0.1  any     anywhere             anywhere             udp dpt:ntp reject-with icmp-port-unreachable
2        0     0 REJECT     tcp  --  wl0.1  any     anywhere             anywhere             tcp dpt:ntp reject-with icmp-port-unreachable
3        0     0 ACCEPT     all  --  wl0.1  !eth0   anywhere             anywhere             state RELATED,ESTABLISHED
4        0     0 ACCEPT     all  --  !eth0  wl0.1   anywhere             anywhere           
5        9   540 YazFiREJECT  all  --  wl0.1  !eth0   anywhere             anywhere           
6        0     0 ACCEPT     all  --  wl0.1  any     anywhere             anywhere           
1        3   200 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             udp dpt:domain
2        0     0 ACCEPT     tcp  --  wl0.1  any     anywhere             anywhere             tcp dpt:domain
3        0     0 ACCEPT     tcp  --  wl0.1  any     anywhere             10.10.185.2         multiport dports www,https
4       28  3387 ACCEPT     all  --  wl0.1  any     anywhere             base-address.mcast.net/4
5        0     0 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             multiport dports netbios-ns,netbios-dgm
6        1   334 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             multiport dports bootps,ntp
7        0     0 ACCEPT     icmp --  wl0.1  any     anywhere             anywhere           
8        0     0 YazFiREJECT  all  --  wl0.1  any     anywhere             anywhere

[C] diff output:
/jffs/tmp/eth0.txt /jffs/tmp/eth8.txt
1        4   240 YazFiREJECT  all  --  wl0.1  any     anywher |    1        0     0 YazFiREJECT  all  --  wl0.1  any     anywher
5        0     0 YazFiREJECT  all  --  wl0.1  !eth0   anywher |    5        9   540 YazFiREJECT  all  --  wl0.1  !eth0   anywher
6      157 28864 ACCEPT     all  --  wl0.1  any     anywhere  |    6        0     0 ACCEPT     all  --  wl0.1  any     anywhere
1       16  1143 ACCEPT     udp  --  wl0.1  any     anywhere  |    1        3   200 ACCEPT     udp  --  wl0.1  any     anywhere
4       54  6658 ACCEPT     all  --  wl0.1  any     anywhere  |    4       28  3387 ACCEPT     all  --  wl0.1  any     anywhere
8        0     0 YazFiREJECT  all  --  wl0.1  any     anywher |    8        0     0 YazFiREJECT  all  --  wl0.1  any     anywher

 

[Ranger802004]

I added below the wl0.1 (YazFi network) iptables [A] On Primary WAN, On secondary WAN and [C] diff output. I do not have a clue if something here is wrong.
I would appreciate any hint

Later edit1: I guess the 5th is the one that is wrong and should change from:
YazFiREJECT all -- wl0.1 !eth0
to:
YazFiREJECT all -- wl0.1 !eth8

[A] On Primary WAN
iptables --line-numbers --list -v | grep "wl0.1"
1        4   240 YazFiREJECT  all  --  wl0.1  any     anywhere            !10.10.175.47      
1        0     0 REJECT     udp  --  wl0.1  any     anywhere             anywhere             udp dpt:ntp reject-with icmp-port-unreachable
2        0     0 REJECT     tcp  --  wl0.1  any     anywhere             anywhere             tcp dpt:ntp reject-with icmp-port-unreachable
3        0     0 ACCEPT     all  --  wl0.1  !eth0   anywhere             anywhere             state RELATED,ESTABLISHED
4        0     0 ACCEPT     all  --  !eth0  wl0.1   anywhere             anywhere          
5        0     0 YazFiREJECT  all  --  wl0.1  !eth0   anywhere             anywhere          
6      157 28864 ACCEPT     all  --  wl0.1  any     anywhere             anywhere          
1       16  1143 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             udp dpt:domain
2        0     0 ACCEPT     tcp  --  wl0.1  any     anywhere             anywhere             tcp dpt:domain
3        0     0 ACCEPT     tcp  --  wl0.1  any     anywhere             10.10.185.2         multiport dports www,https
4       54  6658 ACCEPT     all  --  wl0.1  any     anywhere             base-address.mcast.net/4
5        0     0 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             multiport dports netbios-ns,netbios-dgm
6        1   334 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             multiport dports bootps,ntp
7        0     0 ACCEPT     icmp --  wl0.1  any     anywhere             anywhere          
8        0     0 YazFiREJECT  all  --  wl0.1  any     anywhere             anywhere

[B] On secondary WAN
iptables --line-numbers --list -v | grep "wl0.1"
1        0     0 YazFiREJECT  all  --  wl0.1  any     anywhere            !10.10.175.47      
1        0     0 REJECT     udp  --  wl0.1  any     anywhere             anywhere             udp dpt:ntp reject-with icmp-port-unreachable
2        0     0 REJECT     tcp  --  wl0.1  any     anywhere             anywhere             tcp dpt:ntp reject-with icmp-port-unreachable
3        0     0 ACCEPT     all  --  wl0.1  !eth0   anywhere             anywhere             state RELATED,ESTABLISHED
4        0     0 ACCEPT     all  --  !eth0  wl0.1   anywhere             anywhere          
5        9   540 YazFiREJECT  all  --  wl0.1  !eth0   anywhere             anywhere          
6        0     0 ACCEPT     all  --  wl0.1  any     anywhere             anywhere          
1        3   200 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             udp dpt:domain
2        0     0 ACCEPT     tcp  --  wl0.1  any     anywhere             anywhere             tcp dpt:domain
3        0     0 ACCEPT     tcp  --  wl0.1  any     anywhere             10.10.185.2         multiport dports www,https
4       28  3387 ACCEPT     all  --  wl0.1  any     anywhere             base-address.mcast.net/4
5        0     0 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             multiport dports netbios-ns,netbios-dgm
6        1   334 ACCEPT     udp  --  wl0.1  any     anywhere             anywhere             multiport dports bootps,ntp
7        0     0 ACCEPT     icmp --  wl0.1  any     anywhere             anywhere          
8        0     0 YazFiREJECT  all  --  wl0.1  any     anywhere             anywhere

[C] diff output:
/jffs/tmp/eth0.txt /jffs/tmp/eth8.txt
1        4   240 YazFiREJECT  all  --  wl0.1  any     anywher |    1        0     0 YazFiREJECT  all  --  wl0.1  any     anywher
5        0     0 YazFiREJECT  all  --  wl0.1  !eth0   anywher |    5        9   540 YazFiREJECT  all  --  wl0.1  !eth0   anywher
6      157 28864 ACCEPT     all  --  wl0.1  any     anywhere  |    6        0     0 ACCEPT     all  --  wl0.1  any     anywhere
1       16  1143 ACCEPT     udp  --  wl0.1  any     anywhere  |    1        3   200 ACCEPT     udp  --  wl0.1  any     anywhere
4       54  6658 ACCEPT     all  --  wl0.1  any     anywhere  |    4       28  3387 ACCEPT     all  --  wl0.1  any     anywhere
8        0     0 YazFiREJECT  all  --  wl0.1  any     anywher |    8        0     0 YazFiREJECT  all  --  wl0.1  any     anywher

Yea it is continuing to rebuild the rules with eth0 instead of new wan interface. Not sure if it is hard coded or if they use nvram get wan_ifname from NVRAM, my script does update that value, double check that when you switch to Secondary WAN

 

[rlj2]

I am going to probably incorporate the email function in a later release just need to make it universal where it will bypass if the user doesn’t set it up, which isn’t challenging just need to plan how I want to do it, probably will require a new config variable for enabled or disabled and all of the user variables for email.

Probably the pain with this is , most people use gmail nowaways. I had trouble getting the CA file to work, and using "less secure apps" supposedly stops 5/30/2022. That might be a issue beyond your control, and not worthwhile.. maybe the option

 

[Ranger802004]

Probably the pain with this is , most people use gmail nowaways. I had trouble getting the CA file to work, and using "less secure apps" supposedly stops 5/30/2022. That might be a issue beyond your control, and not worthwhile.. maybe the option

The router has built in support for gmail for the AIProtection alerts so we will see, I use a device password from GMail because I have MFA enabled for my account.

 

[rlj2]

The router has built in support for gmail for the AIProtection alerts so we will see, I use a device password from GMail because I have MFA enabled for my account.

This can be apart of the brand
new fancy gui were getting

 

[Ranger802004]

This can be apart of the brand
new fancy gui were getting

Lol I will look into it and see what I can come up with but at this time no promises.

 

[Ubimo]

I'm a noob, which adress do I have to enter here?

I know my pulbic WAN IP, but I don't know what's a WAN Target IP.
I figured out, the IP adress in the screenshot indicates my WAN Gateway.
Thanks!

Edit:
Added screenshot of overview: