pfSense Support Subscription

Author Topic: Does tinc do multihomed failover?  (Read 579 times)

0 Members and 1 Guest are viewing this topic.

Offline ttblum

  • Full Member
  • ***
  • Posts: 181
  • Karma: +3/-0
    • View Profile
Does tinc do multihomed failover?
« on: April 09, 2015, 09:13:34 am »
Hello,

     I have a setup where multiple branch offices with dual internet connections need to connect to my site via a VPN connection to access a server.  My site only has one internet connection.

     Failover on IPSec is impossible, and OpenVPN's failover failback functionality seems a little crude. 

     Is tinc able to failover and failback with dual internet connections?

Offline weltonrodrigo

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
Re: Does tinc do multihomed failover?
« Reply #1 on: October 27, 2015, 06:14:51 pm »
Hi,

i deal with a site with two internet connections who talks to a single connected master site over OpenVPN:

Code: [Select]

       +-----------------+
       |                 |
       |  Remote site    |
       |                 |
       +-----------------+
             |      |
             |      |
             |      v
             v   XXXXX
            XXXXXX   XX
         XXX          X
         XX  internet X
          XXXXXX   XXXX
               XXXX
                ^
                |
                |
       +-----------------+
       |                 |
       |  master site    |
       |                 |
       +-----------------+




To it works wonderfully.

Master site is linux, remote site is pfsense.

This is how I got it:

At the remote site:
  • Create a gateway group with your connections in two different tiers (failover)
  • Configure a firewall rule redirecting outgoing OpenVpn tunnel traffic (normally UDP traffic on port 1194) to this gateway group
  • Have fun

At master site:
  • Check option "Allow connected clients to retain their connections if their IP address changes."
  • Sit back and relax.

You'll lost connection for a few seconds while openvpn detects the IP change, but after that, traffic will resume.

Offline ttblum

  • Full Member
  • ***
  • Posts: 181
  • Karma: +3/-0
    • View Profile
Re: Does tinc do multihomed failover?
« Reply #2 on: October 28, 2015, 11:45:32 am »
This is off-topic, but I've been running the server portion of OpenVPN at the remote offices, listening on the failover gateway, and running the clients at the central site.

I add this to the client config at the central site:

remote rmt.fai.ovr.con pporrtt;
keepalive 1 4;

Seems to work pretty well. 

Total time to failover = failover timeout configured on gateway group + failover timeout configured by the keepalive statement on the client

I believe the above OpenVPN timeout is set to 4 seconds