enfrentei um problema semelhante .. e estava muito interessado na abordagem da solução de acordo com o primeiro cenário do sr. GTH e Anatoli, peço que você faça as configurações e scripts básicos, se possível, para testar a configuração descrita no primeiro cenário.
agora eu configurei as conexões VPN através de diferentes provedores de ISP, usando interfaces tun / tap combinadas (não está vinculado, o que é explicado na resposta # 8) com este utilitário:
Net-ISP-Balance por Lincoln D. Stein
Faça o balanceamento de carga da sua conexão à Internet em dois ou mais ISPs para melhorar a largura de banda e a confiabilidade
Página inicial do projeto:
https://lstein.github.io/Net-ISP-Balance/
Este pacote permite balancear a carga de uma conexão à Internet doméstica ou de uma empresa de pequeno porte em dois ou mais ISPs. Você pode usá-lo com um único host conectado a dois ISPs ou em um roteador / firewall para equilibrar a carga em toda a LAN. O tráfego de rede é balanceado nas duas conexões ISP para aumentar a capacidade de upload e download e, se um ISP falhar, o outro ISP assumirá o controle automaticamente.
A largura de banda é distribuída em um nível por conexão. Isso significa que você não verá a largura de banda agregada em nenhum download ou benchmark de velocidade específico, mas verá os benefícios quando várias transferências de dados estiverem ocorrendo simultaneamente, por exemplo, quando várias pessoas em sua casa estiverem transmitindo filmes. Além disso, os protocolos de transferência de arquivos com várias conexões, como o BitTorrent, verão os benefícios do balanceamento de carga.
este é um utilitário baseado em Perl para gerenciamento de roteamento e iptables no Linux, perfeito para nossos propósitos; de fato, primeiro cria uma tabela de roteamento para todos os provedores e depois distribui todo o tráfego da LAN igualmente entre os provedores, para entender como o utilitário funciona, sugerir considerar um pequeno exemplo (configuração de teste) para 3 isp + 1 lan
#cat /etc/network/balance.conf
##service device role ping-ip
CABLE3 enp0s3 isp 10.0.2.2
CABLE8 enp0s8 isp 10.0.3.2
CABLE9 enp0s9 isp 10.0.4.2
LAN enp0s10 lan
#cat /etc/network/interfaces
auto enp0s3
allow-hotplug enp0s3
iface enp0s3 inet dhcp
auto enp0s8
allow-hotplug enp0s8
iface enp0s8 inet dhcp
auto enp0s9
allow-hotplug enp0s9
iface enp0s9 inet dhcp
auto enp0s10
allow-hotplug enp0s10
iface enp0s10 inet static
address 192.168.1.1/24
#Now work Net-ISP-Balance utility:
## Including rules from /etc/network/balance/pre-run/pre-run-script.pl ##
## Finished /etc/network/balance/pre-run/pre-run-script.pl ##
echo 0 > /proc/sys/net/ipv4/ip_forward
ip route flush all
ip rule flush
ip rule add from all lookup main pref 32766
ip rule add from all lookup default pref 32767
ip route flush table 2
ip route flush table 1
ip route flush table 3
ip route add 10.0.2.0/24 dev enp0s3 src 10.0.2.15
ip route add 10.0.3.0/24 dev enp0s8 src 10.0.3.15
ip route add 10.0.4.0/24 dev enp0s9 src 10.0.4.15
ip route add 0.0.0.0/0 dev enp0s10 src
ip route add default scope global nexthop via 10.0.4.2 dev enp0s9 weight 1 nexthop via 10.0.3.2 dev enp0s8 weight 1 nexthop via 10.0.2.2 dev enp0s3 weight 1
ip route add table 2 default dev enp0s3 via 10.0.2.2
ip route add table 2 10.0.2.0/24 dev enp0s3 src 10.0.2.15
ip route add table 2 10.0.3.0/24 dev enp0s8 src 10.0.3.15
ip route add table 2 10.0.4.0/24 dev enp0s9 src 10.0.4.15
ip route add table 2 0.0.0.0/0 dev enp0s10 src
ip rule add from 10.0.2.15 table 2
ip rule add fwmark 2 table 2
ip route add table 1 default dev enp0s8 via 10.0.3.2
ip route add table 1 10.0.2.0/24 dev enp0s3 src 10.0.2.15
ip route add table 1 10.0.3.0/24 dev enp0s8 src 10.0.3.15
ip route add table 1 10.0.4.0/24 dev enp0s9 src 10.0.4.15
ip route add table 1 0.0.0.0/0 dev enp0s10 src
ip rule add from 10.0.3.15 table 1
ip rule add fwmark 1 table 1
ip route add table 3 default dev enp0s9 via 10.0.4.2
ip route add table 3 10.0.2.0/24 dev enp0s3 src 10.0.2.15
ip route add table 3 10.0.3.0/24 dev enp0s8 src 10.0.3.15
ip route add table 3 10.0.4.0/24 dev enp0s9 src 10.0.4.15
ip route add table 3 0.0.0.0/0 dev enp0s10 src
ip rule add from 10.0.4.15 table 3
ip rule add fwmark 3 table 3
## Including rules from /etc/network/balance/routes/01.local_routes ##
# enter any routing commands you might want to go in
# for example:
# ip route add 192.168.100.1 dev eth0 src 198.162.1.14
## Finished /etc/network/balance/routes/01.local_routes ##
## Including rules from /etc/network/balance/routes/02.local_routes.pl ##
## Finished /etc/network/balance/routes/02.local_routes.pl ##
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -N DROPGEN
iptables -A DROPGEN -j LOG -m limit --limit 1/minute --log-level 4 --log-prefix "GENERAL: "
iptables -A DROPGEN -j DROP
iptables -N DROPINVAL
iptables -A DROPINVAL -j LOG -m limit --limit 1/minute --log-level 4 --log-prefix "INVALID: "
iptables -A DROPINVAL -j DROP
iptables -N DROPPERM
iptables -A DROPPERM -j LOG -m limit --limit 1/minute --log-level 4 --log-prefix "ACCESS-DENIED: "
iptables -A DROPPERM -j DROP
iptables -N DROPSPOOF
iptables -A DROPSPOOF -j LOG -m limit --limit 1/minute --log-level 4 --log-prefix "DROP-SPOOF: "
iptables -A DROPSPOOF -j DROP
iptables -N DROPFLOOD
iptables -A DROPFLOOD -m limit --limit 1/minute -j LOG --log-level 4 --log-prefix "DROP-FLOOD: "
iptables -A DROPFLOOD -j DROP
iptables -N DEBUG
iptables -A DEBUG -j LOG --log-level 3 --log-prefix "DEBUG: "
iptables -t mangle -N MARK-CABLE3
iptables -t mangle -A MARK-CABLE3 -j MARK --set-mark 2
iptables -t mangle -A MARK-CABLE3 -j CONNMARK --save-mark
iptables -t mangle -N MARK-CABLE8
iptables -t mangle -A MARK-CABLE8 -j MARK --set-mark 1
iptables -t mangle -A MARK-CABLE8 -j CONNMARK --save-mark
iptables -t mangle -N MARK-CABLE9
iptables -t mangle -A MARK-CABLE9 -j MARK --set-mark 3
iptables -t mangle -A MARK-CABLE9 -j CONNMARK --save-mark
iptables -t mangle -A PREROUTING -i enp0s10 -m conntrack --ctstate NEW -m statistic --mode random --probability 1 -j MARK-CABLE9
iptables -t mangle -A PREROUTING -i enp0s10 -m conntrack --ctstate NEW -m statistic --mode random --probability 0.5 -j MARK-CABLE8
iptables -t mangle -A PREROUTING -i enp0s10 -m conntrack --ctstate NEW -m statistic --mode random --probability 0.333333333333333 -j MARK-CABLE3
iptables -t mangle -A PREROUTING -i enp0s10 -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -i enp0s3 -m conntrack --ctstate NEW -j MARK-CABLE3
iptables -t mangle -A PREROUTING -i enp0s3 -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -i enp0s8 -m conntrack --ctstate NEW -j MARK-CABLE8
iptables -t mangle -A PREROUTING -i enp0s8 -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -i enp0s9 -m conntrack --ctstate NEW -j MARK-CABLE9
iptables -t mangle -A PREROUTING -i enp0s9 -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -d 127.0.0.0/8 -j DROPPERM
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN,ACK ACK -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK ACK -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROPFLOOD
iptables -A INPUT -i enp0s10 -s 0.0.0.0/0 -j ACCEPT
iptables -A OUTPUT -o enp0s10 -d 0.0.0.0/0 -j ACCEPT
iptables -A OUTPUT -o enp0s10 -d 255.255.255.255/32 -j ACCEPT
iptables -A OUTPUT -p udp -s 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -i enp0s10 -o enp0s3 -s 0.0.0.0/0 ! -d 0.0.0.0/0 -j ACCEPT
iptables -A OUTPUT -o enp0s3 ! -d 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -i enp0s10 -o enp0s8 -s 0.0.0.0/0 ! -d 0.0.0.0/0 -j ACCEPT
iptables -A OUTPUT -o enp0s8 ! -d 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -i enp0s10 -o enp0s9 -s 0.0.0.0/0 ! -d 0.0.0.0/0 -j ACCEPT
iptables -A OUTPUT -o enp0s9 ! -d 0.0.0.0/0 -j ACCEPT
iptables -A OUTPUT -j DROPSPOOF
iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
iptables -t nat -A POSTROUTING -o enp0s8 -j MASQUERADE
iptables -t nat -A POSTROUTING -o enp0s9 -j MASQUERADE
## Including rules from /etc/network/balance/firewall/01.accept ##
## This file contains iptables statements that add additional firewall rules
# allow incoming domain packets -- needed for DNS resolution
iptables -A INPUT -p udp --source-port domain -j ACCEPT
# allow incoming NTP packets -- needed for net time protocol
iptables -A INPUT -p udp --source-port ntp -j ACCEPT
## Finished /etc/network/balance/firewall/01.accept ##
## Including rules from /etc/network/balance/firewall/01.accept.pl ##
iptables -A INPUT -p tcp -s 0.0.0.0/0 --syn --dport ssh -j ACCEPT
## Finished /etc/network/balance/firewall/01.accept.pl ##
## Including rules from /etc/network/balance/firewall/02.forward.pl ##
iptables -A FORWARD -p udp --source-port domain -d 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -p udp --source-port ntp -d 0.0.0.0/0 -j ACCEPT
## Finished /etc/network/balance/firewall/02.forward.pl ##
echo 1 > /proc/sys/net/ipv4/ip_forward
## Including rules from /etc/network/balance/post-run/post-run-script.pl ##
## Finished /etc/network/balance/post-run/post-run-script.pl ##