How to distribute connections between two wan-ip interfaces
-
@Gertjan said in [How to distribute connections between two wan-ip interfaces]
Ad @dotdash above : use a OpenVPN settings file for each the WAN connections. Use 2 separate OpenVPN servers processes.
I would actually advise him to follow the 'port forward method' of multi-WAN described in the book. Perhaps if the loads were very high, it might make sense to have separate processes. I've never heard of binding to all interfaces before this thread, and it seems a bit sloppy...
https://docs.netgate.com/pfsense/en/latest/book/openvpn/openvpn-and-multi-wan.html -
@dotdash
I don't know if I understood your answer very well.
But I'm already using the advanced configuration options with a list of URLs (vpn.company.com.br / vpn2.company.com.br), but, by default, I always connect to (vpn.company.com.br) that way connections are never balanced. -
@Gertjan
I think I understand your suggestion, because of COVID-19, I already have many clients connected remotely to the office and I believe that if I use this configuration option with 2 OpenVPN servers, these clients may have connection problems. -
I thought I was clear, but I'll be more specific-
Add the line
remote-random
to the client openvpn config file.
This can be included in the installer by adding it to the advanced configuration options on the client export page. -
@dotdash
My problem is not in the CPU usage of my server, this load is very low, despite having 40 clients connected simultaneously to the OpenVPN server. I believe that this port forwarding solution should be an option.last pid: 77788; load averages: 0.18, 0.11, 0.11 up 70+15:28:24 11:26:10 77 processes: 1 running, 68 sleeping, 8 zombie CPU: 0.5% user, 0.0% nice, 0.5% system, 0.1% interrupt, 98.9% idle Mem: 64M Active, 204M Inact, 678M Wired, 176K Buf, 2984M Free ARC: 217M Total, 42M MFU, 165M MRU, 331K Anon, 1059K Header, 9024K Other 96M Compressed, 204M Uncompressed, 2.14:1 Ratio Swap: 2048M Total, 2048M Free PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 30696 root 1 20 0 16356K 13684K select 1 16:17 2.02% openvpn 52568 root 1 21 0 97764K 36552K accept 1 0:28 0.60% php-fpm 425 root 1 20 0 99812K 38836K accept 2 0:35 0.31% php-fpm 99249 www 1 20 0 20692K 15620K kqread 1 2:09 0.16% haproxy 58210 root 1 20 0 6404K 2632K select 3 113:32 0.14% syslogd -
@dotdash
As shown in the image below?
-
Yes, that looks correct.
-
@dotdash said in How to distribute connections between two wan-ip interfaces:
Yes, that looks correct.
My doubts are ..
After using this parameter, it is necessary to update the config.OVPN of all clients that are already configured on their computers.What if, after using this parameter, load balancing is done between the wan1-ip / wan2-ip interfaces, which listen to the URLs (vpn.company.com.br / vpn2.company.com.br)?
-
Hmm I never tried with (Open)VPN and maybe it's kind of shoddy....you could also round robin your DNS (target IPs).
-Rico
-
@wesleylc1 said in How to distribute connections between two wan-ip interfaces:
My doubts are ..
After using this parameter, it is necessary to update the config.OVPN of all clients that are already configured on their computers.Yes, for existing clients, you would need to edit the ovpn config, or re-import the config.
What if, after using this parameter, load balancing is done between the wan1-ip / wan2-ip interfaces, which listen to the URLs (vpn.company.com.br / vpn2.company.com.br)?
My understanding of this setting is that it is only client-specific. When the client starts, it randomizes the order of the servers in the config. In theory, half your clients will pick vpn2 as their first choice. Once a particular client has started, it will continue to prefer the same server until they exit the OpenVPN client and re-load it.
-
@dotdash
How to validate if the customer connected to "vpn2.company.com.br", after including the parameter in .config.OVPN? -
@wesleylc1
If you are running a single openvpn server, I think you would need to check the state table to see which connection clients came in on. -
@dotdash
According to the image, this client connected to WAN2-IP, after including "remote-random" in config.OVPN.
But is it possible to validate clients by accessing the two WAN interfaces in a balanced way?
-
@wesleylc1 said in How to distribute connections between two wan-ip interfaces:
@dotdash
According to the image, this client connected to WAN2-IP, after including "remote-random" in config.OVPN.
But is it possible to validate clients by accessing the two WAN interfaces in a balanced way?According to this other image, it is possible to identify that the same client made a connection using WAN1-ip, aleratorically, but during this connection there were few clients connected, compared to the moment of the first image.
-
The remote-random option only randomizes the server order on the client side. It is never going to work in any sort of balanced or intelligent way. You could look at a front end load balancer, but that is beyond the scope of this topic, or this forum.
-
@dotdash
I understand that, at this point, it may be a random solution, but I want a solution that works intelligently as a load balancer between the two WAN interfaces. Do you think a new topic should be opened for that matter? -
@Rico said in How to distribute connections between two wan-ip interfaces:
Hmm I never tried with (Open)VPN and maybe it's kind of shoddy....you could also round robin your DNS (target IPs).
Dear @rico, I didn't understand your interaction, can you try to explain to me what can be bad about using DNS to the destination IPs?
-
Round robin DNS is simply adding both IPs to the DNS record. It is no more sophisticated than using the remote-random option. If you want something more intelligent, I would suggest an actual load balancer. I believe Kemp still has a free version available. I'd look into something like that, because it seems you will not be happy with the fairly crude methods available directly in OpenVPN.
-
@dotdash
Do you believe that load balancing is possible with HAProxy? -
HAProxy doesn't work with UDP. You could possibly switch to TCP (and reduce performance for you clients) and hack something together. I don't know. You could ask in the packages section, but ultimately I do not think it will be satisfactory. In my opinion, you can just go the easy and ugly way with remote-random, or get an actual load balancer and do it right.
