[pfSense] Multi-WAN Setup with HA & PPPoE v2.0.3

[WolfSec-Support]

Hello,

found nothing useable till now.

setup in place / clear for me:
- 2 boxes in HA setup / CARP IP only in LAN
- all connections to both boxes via vlans in a failover LAGG on 2 nics per box
- 2 cheap internet links via 2 different providers (cable and pppoe)
- vlan 100 for cable modem (internet A via DHCP)
- vlan 200 for connection to DSL modem internet B
- both boxes see all vlans (LAN and Internet 2x + sync interface)
- all traffic goes trough box master
- box slave only if box master fails completely


wished functionality / setup:
- internet A for all other traffic (surfing / email / vpn) / traffic X
- internet B for a subnet (official IP's of voip provider) only / traffic Y
- so to have no dynamic balancing

- slavebox will be only used if master box fails completely
- masterbox sends all traffic (X and Y) via internet A if internet B
fails / vice versa via Internet B if internet A fails

known:
- internal CARP IP / external not, so:
- sure, internet is NOT stateful in this setup in a case of failover
- VPN will go down and up in case of failover - so also not stateful


version a)
- internet A on both boxes via DHCP (official IP's)
- internet B on master box via PPPoE ( 1 official IP)
- slave box is NOT using PPPoE connection, untill box master fails
- if box master comes back, box slave will disconnect PPPoE, after box
master is up AND running AND back the active CARP MASTER member
- so LAN "CARP BACKUP" can trigger PPPoE down

version b)
same as a)
exception: if PPPoE failover is NOT possible,
- to put in front of PPPoE a cheap DSL-NAT-router
- same setup but internet B is now also via DHCP (different 192.168.x.y/24 net)
- so both boxes have permanent access via internet A and B via DHCP
(sure, in different subnets)

any hints are welcome

thanks in advance

stephan

[WolfSec-Support]

Hello all,

any hint ?

thanks in advance
stephan

Post by WolfSec-Support
Hello,
found nothing useable till now.
- 2 boxes in HA setup / CARP IP only in LAN
- all connections to both boxes via vlans in a failover LAGG on 2 nics per box
- 2 cheap internet links via 2 different providers (cable and pppoe)
- vlan 100 for cable modem (internet A via DHCP)
- vlan 200 for connection to DSL modem internet B
- both boxes see all vlans (LAN and Internet 2x + sync interface)
- all traffic goes trough box master
- box slave only if box master fails completely
- internet A for all other traffic (surfing / email / vpn) / traffic X
- internet B for a subnet (official IP's of voip provider) only / traffic Y
- so to have no dynamic balancing
- slavebox will be only used if master box fails completely
- masterbox sends all traffic (X and Y) via internet A if internet B
fails / vice versa via Internet B if internet A fails
- sure, internet is NOT stateful in this setup in a case of failover
- VPN will go down and up in case of failover - so also not stateful
version a)
- internet A on both boxes via DHCP (official IP's)
- internet B on master box via PPPoE ( 1 official IP)
- slave box is NOT using PPPoE connection, untill box master fails
- if box master comes back, box slave will disconnect PPPoE, after box
master is up AND running AND back the active CARP MASTER member
- so LAN "CARP BACKUP" can trigger PPPoE down
version b)
same as a)
exception: if PPPoE failover is NOT possible,
- to put in front of PPPoE a cheap DSL-NAT-router
- same setup but internet B is now also via DHCP (different 192.168.x.y/24 net)
- so both boxes have permanent access via internet A and B via DHCP
(sure, in different subnets)
any hints are welcome
thanks in advance
stephan

--
Stephan Wolf

WolfSec
Rairing 65
CH-8108 Dällikon

[phone]
[phone]
http://www.wolfsec.ch

[Adam Thompson]

Post by WolfSec-Support
Hello,
found nothing useable till now.
- 2 boxes in HA setup / CARP IP only in LAN
- all connections to both boxes via vlans in a failover LAGG on 2 nics per box
- 2 cheap internet links via 2 different providers (cable and pppoe)
- vlan 100 for cable modem (internet A via DHCP)
- vlan 200 for connection to DSL modem internet B
- both boxes see all vlans (LAN and Internet 2x + sync interface)
- all traffic goes trough box master
- box slave only if box master fails completely

Sounds about right.

Post by WolfSec-Support
- internet A for all other traffic (surfing / email / vpn) / traffic X
- internet B for a subnet (official IP's of voip provider) only / traffic Y
- so to have no dynamic balancing

This part is easy, using just routes.
Or you could use policy-based routing, which is done by specifying in a
firewall rule which gateway to use for forwarding.
It is also possible to do policy-routing-like things with NAT, if you
want.

Post by WolfSec-Support
- slavebox will be only used if master box fails completely

You already have this.

Post by WolfSec-Support
- masterbox sends all traffic (X and Y) via internet A if internet B
fails / vice versa via Internet B if internet A fails

If you use routes (static or dynamic, depending on what your ISP
offers) to accomplish this, it should be automatic.

Post by WolfSec-Support
- sure, internet is NOT stateful in this setup in a case of failover
- VPN will go down and up in case of failover - so also not stateful

I thought we had stateful DHCP, but I could be mistaken - I don't use
that setup.

Post by WolfSec-Support
version a)
- internet A on both boxes via DHCP (official IP's)

OK so far.

Post by WolfSec-Support
- internet B on master box via PPPoE ( 1 official IP)

OK so far.

Post by WolfSec-Support
- slave box is NOT using PPPoE connection, untill box master fails
- if box master comes back, box slave will disconnect PPPoE, after box
master is up AND running AND back the active CARP MASTER member
- so LAN "CARP BACKUP" can trigger PPPoE down

Not sure how (or if!) this works right now, hopefully someone else can
comment.

Post by WolfSec-Support
version b)
same as a)
exception: if PPPoE failover is NOT possible,
- to put in front of PPPoE a cheap DSL-NAT-router
- same setup but internet B is now also via DHCP (different
192.168.x.y/24 net)

Use static routing on both the cheap DSL router and the pfSense cluster
to avoid having to use DHCP, and you *may* also want to disable NAT on
that interface in this scenario, to avoid double-NAT. It may not be
possible (and/or feasible) to disable NAT on pfSense, it depends on many
variables.

Post by WolfSec-Support
- so both boxes have permanent access via internet A and B via DHCP
(sure, in different subnets)
any hints are welcome

Other than the PPPoE failover, I don't know what hints you need - it
sounds like you have a good plan.

-Adam Thompson
***@athompso.net