Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPsec multi-wan failover

    Scheduled Pinned Locked Moved IPsec
    40 Posts 21 Posters 38.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      reinaldo.gomes
      last edited by

      I figured out what was wrong.

      I was testing this failover feature by "marking the gateway as down", right at the "System -> Routing -> Edit Gateway -> Force State".
      This causes the DDNS service to imediatly update your DDNS record, but not the IP in the IPSEC conf file. Now I tested the failover by using the "ifconfig emx down" command, and this time both DDNS (though with some minor delay when compared to the previous option) and IPSEC updated the IP according to the active gateway's IP.

      So, IPSEC doesn't update it's active gateway's IP when using the "mark this gateway as down" option. Is this working as intended?

      1 Reply Last reply Reply Quote 0
      • nzkiwi68N
        nzkiwi68
        last edited by

        And, we still have the bug that I posted:

        IPSEC bound to WAN gateway group and Dynamic DNS doesn't to fail back tunnel to WAN on DDNS update
        https://redmine.pfsense.org/issues/6370

        What can I do to get this issue looked at? It still an open bug, but, not confirmed nor assigned for fixing.

        1 Reply Last reply Reply Quote 0
        • S
          st_rupp
          last edited by

          Same here.
          Got a fast but unstable Vodafone cable Link (primary) and a slow but solid Telekom ADSL (backup).
          Last night, the cable link went down and up again several times. Due to the setting "enable default gateway switching" my servers were still reachable via a DynDns, but my site2site Ipsec tunnel (to DR Location) would use the wrong IP even after DynDns being updated.
          The tunnel was still shown as active in the morning, but no traffic was passing. Using the Restart button to restart IPSec did NOT solve the Problem, manually stopping and starting IPsec again DOES solve the problem…

          Had the same behaviour several times before...

          BTW: using latest 2.3.1_5

          @Steven Perreau: Did you also post a Bug report on Github?  Is this necessary / useful / recommended? I don't know which platform ist used by the Developers...

          1 Reply Last reply Reply Quote 0
          • luckman212L
            luckman212 LAYER 8
            last edited by

            @st_rupp:

            Using the Restart button to restart IPSec did NOT solve the Problem, manually stopping and starting IPsec again DOES solve the problem…

            I was working on a dual-WAN system yesterday where one of the links was flapping.  Had the exact same problem. Scratched my head for a while before trying what you did (completely stopping and then afterwards starting the Ipsec service)

            1 Reply Last reply Reply Quote 0
            • E
              enriluis
              last edited by

              @jimp:

              Not yet. That's really all there is to it though.

              Setup DynDNS, set to use a failover gateway group.
              Setup IPsec to use the same failover gateway group.
              Set the other end to use the dyndns host as the peer address.

              Sorry but i don't have DynDNS access to make the setup because both firewall are in my internal network(no internet access), so exist  another way to work ipsec  over multi-wan failover
              sorry about my English

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                No, Dynamic DNS is the only viable way at the moment.

                Use an internal dynamic DNS server then. Setup BIND somewhere with an RFC2136 dynamic zone and have the other firewall use it to resolve hosts for a private domain.

                That's all out of scope for this thread/board though.

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • E
                  enriluis
                  last edited by

                  another question… can i use gateway group in the local endpoint??? because it are show in  my interface list
                  @jimp:

                  No, Dynamic DNS is the only viable way at the moment.

                  Use an internal dynamic DNS server then. Setup BIND somewhere with an RFC2136 dynamic zone and have the other firewall use it to resolve hosts for a private domain.

                  That's all out of scope for this thread/board though.

                  i was think make that but unknown  how to, i'm using windows server 2012 as internal DNS Server …  is possible make over it?? or another possible solution found here  http://arkanis.de/weblog/2015-11-27-build-your-own-dyndns  correct me please thank

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by

                    If it's an internal DNS server on one side or the other, then you'd have to expose that to the Internet which probably isn't what you want. It's best to have it be a server with a dedicated static address if possible. If it's all internal you end up in a catch 22/chicken-egg scenario. To reach the DNS server you need the VPN, but without the VPN, you can't reach the DNS server.

                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    1 Reply Last reply Reply Quote 0
                    • nzkiwi68N
                      nzkiwi68
                      last edited by

                      IPSEC failover using Dynamic DNS and multi WAN has never worked properly on any of my sites since 2.2. It has with all my testing just hung, never updated the dynamic DNS and never failed over. It looks like bug 7719 which is fixed in 2.4.0 looks like it finally solves Dynamic DNS. It looks like it was an issue with gateway groups.

                      https://redmine.pfsense.org/issues/7719

                      I will be testing as soon as 2.4.0 is released and I'll report my findings!

                      1 Reply Last reply Reply Quote 0
                      • S
                        stevehaley
                        last edited by

                        @Steven:

                        IPSEC failover using Dynamic DNS and multi WAN has never worked properly on any of my sites since 2.2. It has with all my testing just hung, never updated the dynamic DNS and never failed over. It looks like bug 7719 which is fixed in 2.4.0 looks like it finally solves Dynamic DNS. It looks like it was an issue with gateway groups.

                        https://redmine.pfsense.org/issues/7719

                        I will be testing as soon as 2.4.0 is released and I'll report my findings!

                        Does it work?

                        1 Reply Last reply Reply Quote 0
                        • B
                          barnettd
                          last edited by

                          I haven't tested extensively, but the 2.4.0 update did not seem to resolve failover issues on my end. Would be really interested in results from other people though.

                          1 Reply Last reply Reply Quote 0
                          • D
                            d1ego
                            last edited by

                            Dear All,

                            Is there any recent guides on this topic? Finally I'd like to implement multi-wan fail-over, but can't understand completely how. The main concern is do I have to use Dynamic DNS or it is possible to avoid this technique and use a sort of routing protocols?
                            On other side for me it's not a must to use IP Sec, I take OpenVPN to achieve my goal.

                            Thanks for your replies in advance!

                            1 Reply Last reply Reply Quote 0
                            • nzkiwi68N
                              nzkiwi68
                              last edited by

                              Right, my latest testing on 2.4.3 is ddns still does NOT work.

                              I can't believe that the pfsense team with the various tickets and bugs aren't actually fixing things and not testing it, (e.g. bug 8333) so that got me thinking.
                              https://redmine.pfsense.org/issues/8333

                              I wonder if the issue is:

                              My gateway group consists of 2 CARP entries, WAN1 carp and WAN2 carp and I wonder wonder wonder if that's why ddns just never updates!

                              However, as it stands today, 2 pfsense in an HA cluster with multi WAN (WAN1 and WAN2) - on failing WAN1, ddns entry goes RED on the status pages but never actually updates and goes green with the WAN2 carp address.

                              1 Reply Last reply Reply Quote 0
                              • F
                                Fguazelli
                                last edited by

                                Well, i'm one more with the same problem.

                                First of all, PFsense 2.4.2, both sides with Group Gateway Failover, DDNS on Remote Gateway.

                                So, i'm reading a lot of articles and, … i'll test a single change at IPSEC configuration. VPN > IPSEC > Advanced Configuration > Configure Unique IDs as NO.

                                Why ? https://blog.bravi.org/?p=1209

                                I don't know if i misunderstood, but, i'll try this shot …

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.