Netgate 1100 - Dual WAN - Unifi Setup

TXDS

Greetings! I need some advise on an odd scenario and trying to work up some options. I have been using Ubiquity Unifi for all routing and switching needs for many years and have been very pleased overall, but there is one major quirk I am struggling with... Dual WAN...

ISP1: Starlink (200/20 Mbps)
ISP2: Windstream DSL (50/10 Mbps)

Both connections work great, and if I unplug from the UDM Pro directly the failover works just fine. But during an actual outage, it does not fail over properly. This is due to the fact that UDM Pro sees the local link between the modem and the UDM as "live" and therefore does not fail over. Unfortunately I am not seeing a way to change the parameters to fail over based on an external ping or even a latency threshold to help maintain performance. I have read that custom JSON files and whatnot could fix this, but I don't want to go that route. I want to stay in the UI.

This brings me here to pfSense... I am considering purchasing a Netgate 1100 to solve this issue. The goal would be to plug both Starlink and Windstream into the Netgate 1100, and then from the 1100 plug a LAN link to the WAN of the UDM Pro so the Unifi setup treats the Netgate 1100 as the external WAN gateway.

I want to use the Netgate 1100 for WAN failover and make Starlink primary, and fail over to Windstream if there is an outage or poor performance. I want to make it based on both ping and possibly latency, so for example, heavy packet loss or high latency, it will fail over to the better quality connection, and then when the bad connection gets better, then fail back. I assume I will also need to move the security layer such as IPS and such to pfSense if I did this, correct?

Is this possible with the Netgate 1100? Do I need a better device? I have also considered a larger appliance to handle all routing requirements, but then I lose some of the Unifi ability. Any suggestions here would be most helpful.

SteveITS

@TXDS The short answer is yes. See
https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/opt-wan.html

And gateway monitoring:
https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html

stephenw10

Yes, that's possible. Yes the 1100 would be fine for 200Mbps.

Hard for me to comment on replacing the UDM Pro. That's what I would do but I'm biased!

jonallport

I can confirm the Netgate 1100 runs very well with dual WAN, and failover takes but a moment. In my case FTTP (300/50) + LTE (30/10 typical but an upcoming provider swap may improve that). No issues with throughput or performance.

Given your intended deployment I see you might end up with double- (or even triple-) NAT. This may cause you issues with throughput because of fragmentation/retries due to the squeezing of the MTU size with adding so many headers.

Also, one lesson learned from having a radio-based element in the WAN setup - in my case LTE, but probably applies to Starlink, too* - dial-up the latency numbers on the gateway monitoring. Ping times may grow to over 2000ms under load so we don't want the gateway monitor to think it's down just 'cause it's busy!

(the only Starlink I have access to is in a production environment. I don't think my colleagues would be happy if I 'borrowed' it just to test a hunch)