Gateway Backup Links

When the box goes down, the gateway switches by itself to a backup link : a free ethernet port, a phone’s connection sharing over wifi… The zone stays on Internet in degraded mode, then goes back to the box as soon as it responds.

Principle

Every Internet link (the WAN, then the backups) carries its own default route. The lowest metric wins.

Link	Metric
WAN (the box)	100
Backup link	200 + 10 × priority (300 by default)
Return link, in probation	metric + 10000
Link without Internet	metric + 20000

Three situations are covered :

Situation	Detection	Effect
Unplugged cable, box powered off, no DHCP lease anymore	the WAN route disappears	the kernel takes the next route
Box powered on but Internet cut off	the dnf-uplink-monitor probe fails 3 times (about 40 seconds)	the WAN goes to 20100, the backup takes over
Internet back on the box	6 successful probes	switch back to the WAN
Unplugged or changed cable, box restarted, 3 rounds without a route	loss of carrier or of route	the link returns to probation (10100), then finds its place back after 6 successful probes

Why probation

A box that restarts often hands out a lease before having Internet. Without probation, the zone would go back there immediately, for an outage of about 40 seconds. Same effect with a cable changed from one box to another within a few seconds. A link in probation goes behind healthy links, but ahead of dead links.

The probe sends a ping through each link (1.1.1.1 and 9.9.9.9, every 10 seconds). It does not depend on DNS : it targets IP addresses.

The two link types do not wait the same way :

Type	While waiting	Wake-up
ethernet	connected, without traffic (the metric keeps everything on the box)	immediate
wifi	radio off (rfkill) : no connection to the sharing	as soon as no preferred link reaches the Internet

Wifi in radio standby

A phone hotspot is billed by volume and drains the battery. The radio therefore only turns on if the WAN and the higher priority links are down (3 failed probes or no route). It turns off again as soon as a preferred link has succeeded 6 probes in a row. Count about one minute between the outage and the traffic on the wifi.

Declare a backup link

1. Identify the interface on the gateway :

   ip -br link

   It must be free : neither the WAN, nor a LAN port, nor a wifi access point’s radio.

2. Declare the link in the host’s file :

   usr/machines/gw/configuration.nix

   darkone.host.gateway.backupLinks = {
     phone = {
       type = "wifi";
       interface = "wlp4s0";
     };
     voisin = {
       type = "ethernet";
       interface = "enp3s0";
       priority = 20;
     };
   };

   Option	Role
   type	ethernet (DHCP client) or wifi (WPA2/WPA3 client)
   interface	interface that carries the link
   priority	1 to 99, the lowest is preferred among the backups

3. For a wifi link, enter the SSID and the passphrase in sops with just sops :

   usr/secrets/secrets.yaml

   backup-link:
     phone:
       ssid: "Partage du téléphone"
       psk: "passphrase-du-partage"

   The SSID and the passphrase never go through the Nix store.

4. Deploy :

   just apply gw

Verify

networkctl list                       # the link is “routable” when it is active
ip -4 route show default              # the first line is the link in use
rfkill                                # backup wifi radio “blocked” in standby
journalctl -u dnf-uplink-monitor -f   # radio switches and wake-ups, live

With the box down and the phone sharing its connection :

default via 192.168.1.254 dev enp1s0 proto dhcp src 192.168.1.10 metric 20100
default via 192.168.43.1 dev wlp4s0 proto dhcp src 192.168.43.20 metric 300

Tune the probe

Option	Default	Role
darkone.host.gateway.linkCheck.targets	1.1.1.1, 9.9.9.9	pinged addresses, a single reply is enough
darkone.host.gateway.linkCheck.interval	10	seconds between two rounds
darkone.host.gateway.linkCheck.failAfter	3	failures before penalizing a link
darkone.host.gateway.linkCheck.recoverAfter	6	successes before restoring it

Monitoring

The probe publishes three metrics for Prometheus :

Metric	Value
dnf_gateway_link_up	1 if the link has a route and reaches the Internet
dnf_gateway_link_active	1 on the link carrying the default route
dnf_gateway_link_standby	1 on a backup wifi radio turned off and waiting

The GatewayOnBackupLink alert (warning) triggers after 2 minutes on a backup link.

Limits to know about

One radio per role

A wifi card cannot be both an access point and a client. A second card (or a USB dongle) is needed for a wifi backup link.

Link billed by volume

On a phone’s connection sharing or 4G, the whole zone consumes data : updates, backups, caches. Monitor the consumption.

Limit	Detail
Streams cut on switchover	in-progress connections restart over the new link (call or download to relaunch)
Subnet in conflict	a link that hands out addresses from the zone network (e.g. 10.0.0.0/16) breaks routing; a phone’s connection sharing uses a small, distinct network (/24), so no conflict in practice
SSID and passphrase	without double quotes (")
Remote LUKS unlock	over the WAN or the LAN only
Removed links	a running penalty stays until reboot : delete /run/systemd/network/*.network.d/90-dnf-penalty.conf, then networkctl reload