The pfSense Store

Author Topic: How to make OpenVPN failover ?  (Read 2558 times)

0 Members and 1 Guest are viewing this topic.

Offline felipeortega

  • Full Member
  • ***
  • Posts: 135
  • Karma: +0/-0
    • View Profile
    • ConexTI
How to make OpenVPN failover ?
« on: May 03, 2012, 04:18:09 pm »
Hello people,

I wish someone could tell me how to perform a FailOver of OpenVPN?
In my case I have two internet link in the matrix and in the case of my main link goes down, the subsidiary will try to close the VPN at my other link!
It is possible to realize with OpenVPN Site-to-Site  ???
"As pessoas raramente reconhecem a oportunidade porque ela surge disfarçada em trabalho árduo."

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2753
  • Karma: +0/-0
    • View Profile
Re: How to make OpenVPN failover ?
« Reply #1 on: May 08, 2012, 02:24:15 am »
For RoadWarrior on the client side there is this command:
Code: [Select]
remote-random
remote 192.168.10.1 1194
remote 192.168.10.2 1194

So the client tries one connection - if possible to connect it connects. If the line is down it tries the other IP.
Probably you have to enter this as a "custom command" on the client.

If your OpenVPN is running TCP as protocol there is no problem with multiwan but if it is running UDP you should do the following:

Change the listening interface of OpenVPN Server to your "LAN" interface or to "any".
Create a PortForwarding rule to your LAN interface on both of your WAN connections.
Create a firewall rule accordingly to the PortForward rule.
If you do not do this (with UDP) then there are problems because the traffic which comes in on WAN2 will go out WAN1 and so there is a mismatch.

Offline felipeortega

  • Full Member
  • ***
  • Posts: 135
  • Karma: +0/-0
    • View Profile
    • ConexTI
Re: How to make OpenVPN failover ?
« Reply #2 on: May 17, 2012, 08:10:07 am »
Thanks for the response and attention
But I do not quite understand what you mean
How can I do this in pfSense
It would be possible a picture as example?

**Remembering that I'm using OpenVPN and I'm trying not to use IPsec
"As pessoas raramente reconhecem a oportunidade porque ela surge disfarçada em trabalho árduo."

Offline heper

  • Hero Member
  • *****
  • Posts: 675
  • Karma: +0/-0
    • View Profile
Re: How to make OpenVPN failover ?
« Reply #3 on: May 17, 2012, 03:38:46 pm »
try to bind the openvpn to the 'LAN' interface and go from there

or

setup multiple vpn's to same destination (1 from each WAN) then use a routing protocol like ospf to arrange the routing dynamically

Offline felipeortega

  • Full Member
  • ***
  • Posts: 135
  • Karma: +0/-0
    • View Profile
    • ConexTI
Re: How to make OpenVPN failover ?
« Reply #4 on: May 18, 2012, 07:42:17 am »
Thanks for the help Herper

What you say and to be done in the firewall of my branch?

You would have a practical example of the configurations that you said?
Never set up OSPF now I'm lost  ???
"As pessoas raramente reconhecem a oportunidade porque ela surge disfarçada em trabalho árduo."

Offline heper

  • Hero Member
  • *****
  • Posts: 675
  • Karma: +0/-0
    • View Profile
Re: How to make OpenVPN failover ?
« Reply #5 on: May 19, 2012, 05:17:55 am »