Where/How to post Procedure for setting up Dual Wan for current Snapshot?

hoba · Jan 27, 2007, 11:29 PM

Thanks for working on it! :)

Pootle · Feb 3, 2007, 8:44 PM

I'm just setting this up now after upgrading to snap 02-02-2007, I've got load balancing working, just got to put in the failover part now.

I'm just wondering if the load balancing software could (or perhaps the pfsense configuration code set things up), automatically adjust things when 1 element of the pool goes down, and just route all traffic through the remaining elements of the pool? This would be the noob behaviour, advanced users could still control things in detail if they wanted to.

The way it currently is, it seems to me though that this is going to get very complex once you have more than 2 WANS, with 3 for example you need 3 pools to allow for each single WAN failing, and also really you should also have another 3 pools for when any 2 of the 3 have failed. This might be seem a bit overkill, but I can easily see situations where multiple ISPs fail, because they share some common infrastructure, for example if you have 2 ADSL connections and 1 cable connection, the 2 ADSL could easily go down at the same time.

Notionally you need 3 pools for 2 WANs, 7 pools for 3 WANs and 15 pools for 4 WANs ( or is it 25? ). Don't want to think what happens for 5 or more!

hoba · Feb 3, 2007, 8:58 PM

I don't think someone will use THAT many WANs. imo it's rather nice the way it is now and it gives you full control. The only thing that could be enhanced is to have a way to resort the poolmembers for failoverpools without the need of deleting and adding them back (this is more or less cosmetic). Another nice addition would be to automatically update the monitor IPs for dynamic connections.

Vescovo · Feb 5, 2007, 5:09 AM

@hoba:

Another nice addition would be to automatically update the monitor IPs for dynamic connections.

Hoba, hopefully I can figure out how to get the information from the modem/routers without resorting to "device specific code". Since my ISP does "dual wan outgoing load balance" on my connection, that is 2 gateways, this update is essential to check for a real failover condition.

@Pootle:

This might be seem a bit overkill, but I can easily see situations where multiple ISPs fail, because they share some common infrastructure,

My understanding of how the pools work is that if there are 3 items in a Balancing pool, that pool will be balanced amongst the active items and if there are 3 items in a Failover pool, that pool will failover to the next item in the active list. Will this not take care of the situation you mentioned?

for example if you have 2 ADSL connections and 1 cable connection, the 2 ADSL could easily go down at the same time.

We are in agreement. This setup, exactly, is being tested and it will be documented once real results are achieved.

Pootle · Feb 4, 2007, 1:21 AM

My understanding of how the pools work is that if there are 3 items in a Balancing pool, that poll will be balanced amongst the active items and if there are 3 items in a Failover pool, that poll will failover to the next item in the active list. Will this not take care of the situation you mentioned?

Note quite sure I follow this, but leave it for now - its late and I'm still learning.

We are in agreement. This setup, exactly, is being tested and it will be documented once real results are achieved.

Excellent !!

I've got failover working now and have tested and all looks to work fine.

Just 1 question in the meantime I hope has a simple answer :)

What gateway do I choose if I want traffic (from LAN) to favour a particular WAN link, but be able to fail over to the other?

(I understand that choosing the balanced pool can use any WAN as it sees fit,
and that using a specific gateway (for example 192.168.0.1) will force traffic to that WAN connection - which will mean nothing happens if that link fails
If I use a failover gateway, will that favour the first WAN connection mentioned, but then use the other(s) in order when the first fails?)

hoba · Feb 4, 2007, 1:42 AM

Yes, just build a failoverpool for that. It will always use the first available gateway in the list and only failover to the next one if the above gateway(s) are down.

Pootle · Feb 4, 2007, 2:41 PM

I've done this diagram which I think explains the various ways in which a load balancing setup with the new failover capability can be used. Is this right?

Its all working like a charm now, and it is not wrongly reporting link down either. ;D

Vescovo · Feb 4, 2007, 8:40 PM

Hey Pootle, that's an excellent diagram. Why don't you add it to the DOC example. The only difference is the DOC sets the the WAN1(192.168.0.2) and WAN2(192.168.2.2) and The modem/routers to 192.168.0.254 and 192.168.2.254. If you can make those changes it will be consistent with the rest of the DOC.

Pootle · Feb 5, 2007, 12:06 AM

KK, I'll do it in the morning ;D

Pootle · Feb 5, 2007, 2:46 PM

@Vescovo:

Why don't you add it to the DOC example.

Like this? http://doc.pfsense.org/index.php/Multi-Wan/Load-Balancing

btw its from a visio diagram, if anyone wants the visio file, I'm happy to send it…

Vescovo · Feb 5, 2007, 5:54 PM

Hi Pootle, :-[ Unfortunately, I was not specific enough.
In the pfSense Box where you have Gateway 192.168.0.1 it should read 192.168.0.254
In the pfSense Box where you have Gateway 192.168.2.1 it should read 192.168.2.254

At the edge of the pfSense box where you have 192.168.0.254 it should read 192.168.0.2
At the edge of the pfSense box where you have 192.168.2.254 it should read 192.168.2.2

At the entrance to the modem/ routers where you have 192.168.0.2 it should read 192.168.0.254
At the entrance to the modem/ routers where you have 192.168.2.2 it should read 192.168.2.254

To insert the image "in-line" where you thought it would be most helpful you click the image ikon in the menu. It will put code in that looks like this [[Image:Example.jpg]].
You then preview the document. Go to the link where you place the example.jpg. You will not see the image. Click the link. It will take you to a page where you can download the image. Name the image something sensible. Once you save the image it appears where you want it.

To deteremine the location, ask yourself where the image would be most helpful to you in building the pfsense box if you were doing it for the first time.

Thanks very much for contibuting. :D

Pootle · Feb 5, 2007, 7:50 PM

Ah! I see. That explains why I got confused reading the guide :D

I've uploaded a new version, can you check it's now got the right addresses? If OK, then I'll look at editing the page.

Vescovo · Feb 5, 2007, 11:40 PM

It is perfect! ;D It will be interesting to see how you position it. It is good to get new views. This always improves the documentation.

lampie · Feb 11, 2007, 3:00 AM

I also contributed to the documentation. Added the FTP workaround for multiwan and a little cosmetics :)

'''''FTP WORKAROUND'''''

If you want to connect to a FTP server you need to add this workaround to your LAN tab.

Proto Source Port Destination Port Gateway
TCP LAN net * 127.0.0.1 1 - 65535 *

Now the packets are forwarded correctly and you can connect to an FTP server.

'''''pORT FORWARDING'''''

Vescovo · Feb 11, 2007, 9:50 AM

Hey Pootle, you positioning was great. The image was just put in line. It is a little tricky to do it but it worth it to show your image! The image will make it easier for the next person. ;D

Hi Lampie, thanks for you additon. :) I know it is hard to add stuff to the DOCO and make it look good! Unfortunately, I did not get a chance to fully test FTP. My outgoing FTP(passive) has worked with the default rules. Is the workaround is for Inbound or oubound FTP? Why is that rule superior to the default LAN -> Wan1 rule in the Firewalls:Rules image?

Pootle · Feb 11, 2007, 10:11 AM

OK, that's good. I wasn't sure if it was better to link to the picture or put it in line, but you're right, it works well in line.

Just thinking of doing a short note on running in a VM….

lampie · Feb 11, 2007, 7:30 PM

@Vescovo:

Hey Pootle, you positioning was great. The image was just put in line. It is a little tricky to do it but it worth it to show your image! The image will make it easier for the next person. ;D

Hi Lampie, thanks for you additon. :) I know it is hard to add stuff to the DOCO and make it look good! Unfortunately, I did not get a chance to fully test FTP. My outgoing FTP(passive) has worked with the default rules. Is the workaround is for Inbound or oubound FTP? Why is that rule superior to the default LAN -> Wan1 rule in the Firewalls:Rules image?

For active FTP connections (not passive) i needed this rule to make it work. Inbound i still have to test, but that is working out of the box i guess. Without this rule i simply cant make any connection (active) to a FTP server.

What i also noticed is that rebooting the system makes after you add these LAN rules is the best option. I had some problems with not correctly forwarding ports to a designated IP adress. After a reboot this worked fine.

Vescovo · Feb 11, 2007, 8:13 PM

Thanks Lampie, I have also noticed that a reboot after filter changes appears to always make things work that may not have worked before. I will check out your comments later this week.

sullrich · Feb 11, 2007, 8:21 PM

Update to the latest snapshot. There are bits in place to make sure check_reload_status is always running now.

Pootle · Feb 11, 2007, 11:08 PM

Dunno if you spotted it yet Vescovo, but I've amended the document page on multi wan to put in proper wikiheaders so you get a content list at the front - makes it easier to find the bit you want….