Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to use two VPN or MLPPP routers to aggregate, load balance, or fail over between WAN connections from a number of different providers?

Two conditions: 1. We need to keep the external IP constant so we can SSH/VPN in and out, run Exchange, etc. 2. No BGP. That's been the answer to similar questions, but a /24 IP block is not sensible for an office of twenty people.

I'm in an area where T1s and the like are insanely expensive, but WiMax, WiFi and DSL are available. We also get plenty of thunderstorms, so we can't rely on WiFi or WiMax alone. I currently use MLPPP over multiple DSL lines from the same provider, but that doesn't give us enough bandwidth.

share|improve this question
Clarification: We are looking for solutions that give us inbound redundancy, but which can use a hosted server outside our LAN as a proxy/router/vpn endpoint. The existence of multiple paths should be totally invisible to the Internet - only the internal and external routers need to know. – Terence Johnson Jun 28 '10 at 18:32
I just don't see how that's going to happen without something like BGP. How is your external VPN endpoint going to know which WAN link to traverse? – kce Sep 1 '11 at 21:00

You can only do transmit load balancing over the links. Without some form of coordination (ie BGP) others have no way is seeing the multiple return paths.

share|improve this answer
For outbound-only WAN this works pretty well though if you're looking for redundancy with multiple unstable links. We've used PFSense and a Netgear FVS336G for this and both worked well (PFsense was better though). Inbound is a different story though. You've just gotta remember that 2x10Mb != 20Mb connection, but you can get 20Mb of throughput using a sensible load balancing algorithm and multiple streams (i.e. different machines). – Mark Henderson Jun 28 '10 at 1:11

Theoretically, you could tunnel all your traffic over several VPNs, to a hosted server, and NAT everything behind that. Without the like of BGP, that's pretty much the only way to achieve what you're looking for though.

share|improve this answer

There are load balancer that can aggregate VPN, they will put vpn ipsec traffic from on site to another on all the available links, if one of the links goes down the load balancer will maintain the vpn up. there are several brands, i am familiar with the fiberlogic meshvpn unit

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.