Netgate m1n1wall

Author Topic: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4  (Read 65213 times)

0 Members and 2 Guests are viewing this topic.

Offline daedalous

  • Newbie
  • *
  • Posts: 11
  • Karma: +0/-0
    • View Profile
Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« on: September 07, 2010, 04:02:41 pm »
This guide was tested with pfSense-2.0-BETA4-20100905-1704.


1- Go to 'System->Routing' and create a new Group as shown in the
figures.
-- For load balancing, select more than one gateway on the same tier (e.g. tier 1)
-- For failover, select gateways on different tiers (e.g. wan on tier 1, when down will fail to wan2 on tier 2)
Here we created 3 groups:
- Wan1BalanceWan2, for load balancing WAN1 and WAN2
- Wan1FailoverWan2, failover WAN1 | WAN2
- Wan2FailoverWan1, failover WAN2 | WAN1

2- Go to 'System->Routing' and edit WAN and WAN2 gateways.
Fill Monit IP field with a reliable IP address beyond your WAN/WAN2 network that responds to ICMP pings.
The monitor IP address in the figure was taken from OpenDNS as example. Please, use your own IP addresses in your setup.
Here you can also customize advanced settings such as Weight (useful when balancing connections at different speed), Latency and Packet Loss thresholds, and Down time for the alarm to fire.

3- Go to 'Firewall->Rules' and set up rules to direct outbound traffic to your gateway groups, activating Load Balancing and Failover (see attached figures).


DNS and Load Balancing
- Go to 'System->General Setup' and be sure that you have at least one DNS server for each ISP. This ensures that you will have DNS service in case one WAN connection goes down. You may need to setup static routes for each DNS server unless your DNS servers are WAN/WAN2 IP addresses.

Finally, you can check your gateway groups at 'Status->Gateways' page.



Credits and references:

Thanks to jimp for your comments and suggestions!

http://forum.pfsense.org/index.php/topic,27761.0.html
http://forum.pfsense.org/index.php/topic,27127.0.html
http://forum.pfsense.org/index.php/topic,27390.0.html
http://forum.pfsense.org/index.php/topic,27803.0.html
http://forum.pfsense.org/index.php/topic,28044.0.html

« Last Edit: September 09, 2010, 03:11:47 pm by daedalous »

Offline Schnulch

  • Newbie
  • *
  • Posts: 15
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #1 on: September 11, 2010, 04:42:15 am »
Hi,

and thanx a lot for your tutorial, it was a lot of help to me.

But I've got some suggestions to make:

With PFSENSE 2.0 there is no need for 3 gateway groups like in 1.2.3 anymore.

I set up a Outbound loadbalancer with 4 Wan interfaces, one cable 50/2,5 MBit, one ADSL 16/1 MBit, one ADSL 3MBit/384KBit and one ADSL 1MBit/128 KBit.
I only made one gatway group, where 50MBit and 16 MBit are Tier1, the other two (3 and 1Mbit) are Tier2.
Load Balancing works very well between first two lines, if one fails, the other gets all the traffic (Failover in Tier1). If both Tier1 are down, I get Loadbalancing on the Tier2 Interfaces. If one of them fails
too, i get failover in Tier 2.

And you have the benefit of only needing one firewall roule for load balance AND failover.

And, no more relevant with only one firewall rule and one gateway group, but anyway I want to mention that, your screenshot of firewall shows the failover rule before the loadbalancing rule. Since the first rule to match triggers the event of leaving firewall rules, you will only get failover with one line active with your ruleset. As any traffic from lan subnet will be redirected to failover gateway pool, which has two different Tiers, so as long as the Tier1 gateway is online, no traffic will be passed to Gateway with Tier2.

Sincerely
Schnulch


Offline Schnulch

  • Newbie
  • *
  • Posts: 15
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #2 on: September 11, 2010, 05:05:51 am »
Hi again..

btw, I set up a second gateway group, since one of my 4 internet lines (the 16Mbit one) is no longer accepting smtp (Mail out), because a user had some viruses spamming the whole day, so i set up a group with the other 3 gatways, 50Mbit, 3Mbit and 1 Mbit as Tier1, Tier2 and Tier3, and added a firewall rule (before all others) to send pop and smtp (I know, pop would not be needed, but to avoid problems with mail clients useing pop before smtp and then coming to the mailserver with different source IP's) to this gateway group. So Email (on pop/smtp standard ports) always use the 50Mbit line, if it is down, the 3Mbit, and if all else fails, the 1 Mbit line.

i'm not sure, if your attempt with 3 gateway groups with same ruleset in firewall will work as you desired. If you have some spare time to check, i would appreciate your efforts.

Thanks,

Schnulch

Offline daedalous

  • Newbie
  • *
  • Posts: 11
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #3 on: September 12, 2010, 11:09:05 am »
And, no more relevant with only one firewall rule and one gateway group, but anyway I want to mention that, your screenshot of firewall shows the failover rule before the loadbalancing rule. Since the first rule to match triggers the event of leaving firewall rules, you will only get failover with one line active with your ruleset. As any traffic from lan subnet will be redirected to failover gateway pool, which has two different Tiers, so as long as the Tier1 gateway is online, no traffic will be passed to Gateway with Tier2.

You're right, thanks for pointing out. The failover rule before loadbalancing forces the traffic to go always via the online gateway with more priority Tier. That kind of failover rule is generally used when we want some specific traffic to go via certain gateway, for example:

Code: [Select]
Proto  Source   Port Dest  Port        Gateway            Description  
TCP    LAN net    *      *     22 (SSH)   Wan1FailoverWan2   LAN -> WAN1|WAN2
*   LAN net    *      *     *          Wan1BalanceWan2    LAN -> WAN1+WAN2

The above Firewall rules make all outbound SSH traffic to go via WAN1, and if it is down via WAN2. And load balance between WAN1 and WAN2 all else traffic.
« Last Edit: September 12, 2010, 11:12:23 am by daedalous »

Offline daedalous

  • Newbie
  • *
  • Posts: 11
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #4 on: September 12, 2010, 11:27:56 am »
i'm not sure, if your attempt with 3 gateway groups with same ruleset in firewall will work as you desired. If you have some spare time to check, i would appreciate your efforts.

Yesterday I've configured a virtual network with pfsense pfSense-2.0-BETA4-20100905-1704(i386) and 2 routers. I created a Load Balance group (same tier). Then I applied the Firewall Load Balance rule and made sure that I had a DNS for each provider.

Load Balancing worked fine, but for whatever reason failover didn't work. The gateway was correctly marked as offline, but it didn't affect my pfsense routing tables...

Today, I repeated the tests with pfSense-2.0-BETA4-20100911-1502 (i386), but I got even worse results. Not only it didn't work, but the Gateway Status were always 'unknown'. Fortunately, I'm not using pfsense 2.0 in production environments. :)

As I wasn't able to make L.B. and failover work with just 2 gateways, obviously I didn't go for 3. I'll probably repeat the tests in a couple of weeks or so. Sorry.

Offline demarchip

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #5 on: September 12, 2010, 08:03:01 pm »
Hi guys... I tried to configure the gateways in failover mode, like daedalous, and donīt work.

-I configure 2 gateways (1 cable modem and 1 ADSL). I put the monitor IP and Advanced options (weight and Packet Loss thresholds).
-I make the group, Cable Tier1 and ADSL Tier2, tigger by packet loss.



-Put the Firewall-> Rule with advanced option Gateway and select the correct gateway group.

When I go to Status->Gateways menu I see the gateways status itīs Online.



But the status Gateways Group itīs Unknown



In the Status->System Log I can see:

Code: [Select]
Sep 12 21:58:52     php: : The gateway: Fiber_failover_Arnet is invalid/unkown not using it.
Sep 12 21:58:52     php: : The gateway: Fiber_failover_Arnet is invalid/unkown not using it.
Sep 12 21:58:52     php: : Gateways status could not be determined, considering all as up/active.

Iam using the latest version available online:
8.1-RELEASE FreeBSD 8.1-RELEASE #1: Sat Sep 11 15:29:22

This must be related to:
http://forum.pfsense.org/index.php/topic,28212.0.html

Patricio

« Last Edit: September 12, 2010, 08:14:21 pm by demarchip »

Offline daedalous

  • Newbie
  • *
  • Posts: 11
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #6 on: September 13, 2010, 01:38:06 am »
Today, I repeated the tests with pfSense-2.0-BETA4-20100911-1502 (i386), but I got even worse results. Not only it didn't work, but the Gateway Status were always 'unknown'.

Same for me, demarchip, the devel team has made some change that affect gw groups, making impossible to get working load balance or failover.

ticket #889, #876 explains the issue:
http://redmine.pfsense.org/issues/876

« Last Edit: September 13, 2010, 02:32:04 am by daedalous »

Offline stramato

  • Full Member
  • ***
  • Posts: 119
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #7 on: September 13, 2010, 03:59:34 am »
i'm using BETA 4 Sep 11 release now and Load Balancing seems not to work

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14994
  • Karma: +4/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #8 on: September 13, 2010, 07:38:48 am »
Yes, it is broken at the moment, hopefully fixed soon.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14994
  • Karma: +4/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #9 on: September 13, 2010, 08:06:52 am »
What part of "it's broken at the moment" implied it should be fixed yet? :-)
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 14994
  • Karma: +4/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #10 on: September 13, 2010, 03:40:35 pm »
I haven't had a chance to try it yet but there were some fixes checked in. If you update and then gitsync, and maybe reboot after that, it would be worth trying.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline h20ray

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #11 on: October 30, 2010, 10:58:42 pm »
hufft..
i still cant use load balance.. can you help me? sorry for my bad english






Offline roi

  • Jr. Member
  • **
  • Posts: 64
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #12 on: November 01, 2010, 02:25:14 am »
hufft..
i still cant use load balance.. can you help me? sorry for my bad english







The pictures don't load.
Try writing what have you triad to do...
Version   2.0-BETA4 (i386)
AMD Athlon(tm) XP 2000+

Offline h20ray

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #13 on: November 01, 2010, 09:55:27 pm »
Code: [Select]
http://tujuhcahaya.com/oray/pfsense/1.jpg
http://tujuhcahaya.com/oray/pfsense/2.jpg
http://tujuhcahaya.com/oray/pfsense/3.jpg

that is the adress.. im sorry..

Offline h20ray

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: Howto Multi WAN-Load Balancing and failover with pfsense 2.0-BETA4
« Reply #14 on: November 01, 2010, 10:11:05 pm »
Code: [Select]
http://tujuhcahaya.com/oray/pfsense/1.jpg
http://tujuhcahaya.com/oray/pfsense/2.jpg
http://tujuhcahaya.com/oray/pfsense/3.jpg

that is the adress.. im sorry..