Failover to USB mobile modem with limited access

[a8ree]

I've got a few devices that I'd like to route over 3G in the event that the wired line is unavailable. I wouldn't want devices accessing streaming services, downloads etc. (Cost prohibitive) but, for VOIP and home automation systems, I'd like to keep these online.

Is there a way in which to do this?

 

[Martineau]

I've got a few devices that I'd like to route over 3G in the event that the wired line is unavailable. I wouldn't want devices accessing streaming services, downloads etc. (Cost prohibitive) but, for VOIP and home automation systems, I'd like to keep these online.

Is there a way in which to do this?

Here is a possible Dual-WAN Failover (FO) hack; with minimal scripting...i.e. one-liner!

If the Network Services Filter (NSF) GUI meets your needs to accommodate your desired 3G blacklists, you can quickly build the 3G blocking rules:

e.g. 192.168.1.99 has no internet access, 192.168.1.88 can't access xxx.xxx.xxx.xxx and 192.168.1.77 cannot access any remote WEB pages etc.

iptables  --line -t filter -nvL NSFW

Chain NSFW (1 references)
num   pkts bytes target     prot opt in     out     source               destination       
1        0     0 logdrop    tcp  --  br0    eth0    192.168.1.99         0.0.0.0/0         
2        0     0 logdrop    tcp  --  br0    eth0    192.168.2.88         xxx.xxx.xxx.xxx          
3        0     0 logdrop    tcp  --  br0    eth0    192.168.1.77         0.0.0.0/0     tcp dpt:80
4       13   793 RETURN     all  --  br0    eth0    0.0.0.0/0            0.0.0.0/0

then whilst the primary WAN0 is ACTIVE, you would need to use firewall-start to insert a simple rule to disable the 3G-only NSFW rule table.
i.e.

iptables -I NSFW -j RETURN

iptables  --line -t filter -nvL NSFW

Chain NSFW (1 references)
num   pkts bytes target     prot opt in     out     source               destination       
1       22   318 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
2        0     0 logdrop    tcp  --  br0    eth0    192.168.1.99         0.0.0.0/0         
3        0     0 logdrop    tcp  --  br0    eth0    192.168.2.88         xxx.xxx.xxx.xxx           
4        0     0 logdrop    tcp  --  br0    eth0    192.168.1.77         0.0.0.0/0     tcp dpt:80
5       81  5432 RETURN     all  --  br0    eth0    0.0.0.0/0            0.0.0.0/0

so now the three '3G-blocking' rules are ignored.

However,, when the primary WAN0 (e.g. eth0/vlan2 etc.) goes DOWN, the firmware will automatically rebuild the 3G blacklist rules but will now explicitly reference the ACTIVE 3G USB interface e.g. ppp0:

iptables  --line -t filter -nvL NSFW

Chain NSFW (1 references)
num   pkts bytes target     prot opt in     out     source               destination       
1        0     0 logdrop    tcp  --  br0    ppp0    192.168.1.99         0.0.0.0/0         
2        0     0 logdrop    tcp  --  br0    ppp0    192.168.2.88         xxx.xxx.xxx.xxx            
3        0     0 logdrop    tcp  --  br0    ppp0    192.168.1.77         0.0.0.0/0     tcp dpt:80
4        2   116 RETURN     all  --  br0    ppp0    0.0.0.0/0            0.0.0.0/0

so no futher firewall rule/action is required.

Here is the one-line script.....

/jffs/scripts/firewall-start

!#/bin/sh

[ "$1" != "ppp0" ] && iptables -I NSFW -j RETURN # If WAN0 is UP, then disable the 3G blocking rules

NOTE: If NSFW is already used, then you will simply need to manually insert the appropriate 3G blocking rules preferably in your own filter chain e.g. 'Block3G' which is called from the FORWARD chain.

 

[a8ree]

Thanks for the solution. I'll give that a whirl!