Hello,
found nothing useable till now.
setup in place / clear for me:
- 2 boxes in HA setup / CARP IP only in LAN
- all connections to both boxes via vlans in a failover LAGG on 2
nics per box
- 2 cheap internet links via 2 different providers (cable and pppoe)
- vlan 100 for cable modem (internet A via DHCP)
- vlan 200 for connection to DSL modem internet B
- both boxes see all vlans (LAN and Internet 2x + sync interface)
- all traffic goes trough box master
- box slave only if box master fails completely
Sounds about right.
wished functionality / setup:
- internet A for all other traffic (surfing / email / vpn) / traffic
X
- internet B for a subnet (official IP's of voip provider) only /
traffic Y
- so to have no dynamic balancing
This part is easy, using just routes.
Or you could use policy-based routing, which is done by specifying in a
firewall rule which gateway to use for forwarding.
It is also possible to do policy-routing-like things with NAT, if you
want.
- slavebox will be only used if master box fails completely
You already have this.
- masterbox sends all traffic (X and Y) via internet A if internet B
fails / vice versa via Internet B if internet A fails
If you use routes (static or dynamic, depending on what your ISP
offers) to accomplish this, it should be automatic.
known:
- internal CARP IP / external not, so:
- sure, internet is NOT stateful in this setup in a case of failover
- VPN will go down and up in case of failover - so also not stateful
I thought we had stateful DHCP, but I could be mistaken - I don't use
that setup.
version a)
- internet A on both boxes via DHCP (official IP's)
OK so far.
- internet B on master box via PPPoE ( 1 official IP)
OK so far.
- slave box is NOT using PPPoE connection, untill box master fails
- if box master comes back, box slave will disconnect PPPoE, after
box
master is up AND running AND back the active CARP MASTER member
- so LAN "CARP BACKUP" can trigger PPPoE down
Not sure how (or if!) this works right now, hopefully someone else can
comment.
version b)
same as a)
exception: if PPPoE failover is NOT possible,
- to put in front of PPPoE a cheap DSL-NAT-router
- same setup but internet B is now also via DHCP (different
192.168.x.y/24 net)
Use static routing on both the cheap DSL router and the pfSense cluster
to avoid having to use DHCP, and you *may* also want to disable NAT on
that interface in this scenario, to avoid double-NAT. It may not be
possible (and/or feasible) to disable NAT on pfSense, it depends on many
variables.
- so both boxes have permanent access via internet A and B via DHCP
(sure, in different subnets)
any hints are welcome
Other than the PPPoE failover, I don't know what hints you need - it
sounds like you have a good plan.
-Adam Thompson
[email protected]
_______________________________________________
List mailing list
[email protected]
http://lists.pfsense.org/mailman/listinfo/list
